Fallos del tipo CWE-89

12.845 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-18912HIGHManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticateEPSS 1.5%CVE-2021-24747—SEO Booster < 3.8 - Admin+ SQL InjectionEPSS 1.5%CVE-2021-24753—Rich Reviews by Starfish < 1.9.6 - Admin+ SQL InjectionEPSS 1.5%CVE-2019-12710MEDIUMCisco Unified Communications Manager SQL Injection VulnerabilityEPSS 1.5%CVE-2024-23539HIGHApache Fineract: Under certain system configurations, the sqlSearch parameter for specific endpoints was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.EPSS 1.5%CVE-2022-2718HIGHJoomSport – for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authenticated (Admin+) SQL Injection via orderbyEPSS 1.5%CVE-2026-69085CRITICALSiYuan before v3.7.3 SQL Injection via searchDocsEPSS 1.5%CVE-2022-2717HIGHJoomSport – for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authentciated (Admin+) SQL Injection via orderbyEPSS 1.5%CVE-2021-25069—WordPress Download Manager < 3.2.34 - Authenticated SQL Injection to Reflected XSSEPSS 1.5%CVE-2021-26636HIGHMaxboard Remote Code ExecutionEPSS 1.5%CVE-2022-1006—Advanced Booking Calendar < 1.7.1 - Admin+ SQLiEPSS 1.5%CVE-2022-0420—RegistrationMagic < 5.0.2.2 - Admin+ SQL InjectionEPSS 1.5%CVE-2022-1023—Podcast Importer SecondLine < 1.3.8 - Admin+ SQLiEPSS 1.5%CVE-2026-28516CRITICALopenDCIM <= 23.04 SQL Injection in Config::UpdateParameterEPSS 1.5%CVE-2024-43918CRITICALWordPress WBW Product Table PRO plugin <= 1.9.4 - Unauthenticated Arbitrary SQL Query Execution vulnerabilityEPSS 1.5%CVE-2023-5412HIGHImage horizontal reel scroll slideshow <= 13.2 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 1.5%CVE-2022-31058HIGHSQL injection via the field name of a tracker in TuleapEPSS 1.5%CVE-2018-0404—Cisco RV180W Wireless-N Multifunction VPN Router SQL Injection VulnerabilityEPSS 1.5%CVE-2021-22856CRITICALChanGate EnterPrise Co., Ltd property management system - SQL InjectionEPSS 1.5%CVE-2022-0383—WP Review Slider < 11.0 - Admin+ SQL InjectionEPSS 1.5%