Fallos del tipo CWE-89

13.302 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-42740CRITICALWordPress Tainacan plugin <= 1.0.3 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-78260CRITICALWordPress Epayco plugin <= 8.4.6 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-42386CRITICALWordPress Order Delivery Date for WooCommerce plugin <= 4.5.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-57726CRITICALWordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-48875CRITICALWordPress JetSmartFilters plugin <= 3.8.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-52693CRITICALWordPress eCommerce Product Catalog plugin <= 3.5.5 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-61966CRITICALWordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-54843CRITICALWordPress MDTF plugin <= 1.3.7 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-81756CRITICALWordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-42381CRITICALWordPress Funnel Builder by FunnelKit plugin <= 3.15.0.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-66436CRITICALWordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-54187CRITICALWordPress JetEngine plugin <= 3.8.10.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-42747CRITICALWordPress Easy Form Builder plugin <= 4.0.6 - SQL Injection vulnerabilityEPSS 0.4%CVE-2023-4608MEDIUMAn authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command.  This afEPSS 0.4%CVE-2026-39492CRITICALWordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-40797CRITICALWordPress WebinarIgnition plugin <= 4.08.253 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-39441CRITICALWordPress Feed KuantoKusta for WooCommerce – Free plugin <= 5.3 - SQL Injection vulnerabilityEPSS 0.4%CVE-2025-3767HIGHSQL Injection in Centreon BAM boolean KPI listingEPSS 0.4%CVE-2026-57679CRITICALWordPress GeekyBot plugin <= 1.2.5 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-59515CRITICALWordPress AIWU plugin <= 1.5.4 - SQL Injection vulnerabilityEPSS 0.4%