Fallos del tipo CWE-89

13.302 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-39512CRITICALWordPress GeoDirectory plugin <= 2.8.152 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-59533CRITICALWordPress Relevanssi Light plugin <= 1.2.2 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-54812CRITICALWordPress Motors plugin <= 1.4.109 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-59527CRITICALWordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-54825CRITICALWordPress wpDataTables plugin <= 7.4 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-66446CRITICALWordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-66680CRITICALWordPress Locatoraid Store Locator plugin <= 3.9.72 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-59514CRITICALWordPress Buddyboss Platform plugin <= 3.0.5 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-39530CRITICALWordPress SpeakOut! Email Petitions plugin <= 4.6.5 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-39494CRITICALWordPress Product Filter by WBW plugin <= 3.1.2 - SQL Injection vulnerabilityEPSS 0.4%CVE-2025-22799HIGHWordPress Neon Product Designer Plugin <= 2.2.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-49076CRITICALWordPress JetEngine plugin <= 3.8.9.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-61966CRITICALWordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2023-4608MEDIUMAn authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command.  This afEPSS 0.4%CVE-2026-57679CRITICALWordPress GeekyBot plugin <= 1.2.5 - SQL Injection vulnerabilityEPSS 0.4%CVE-2025-20620HIGHSQL Injection vulnerability exists in STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected product may EPSS 0.4%CVE-2026-73185CRITICALWordPress NGG Smart Image Search plugin < 4.0.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-54843CRITICALWordPress MDTF plugin <= 1.3.7 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-73187CRITICALWordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-42684CRITICALWordPress WP Job Portal plugin <= 2.5.1 - SQL Injection vulnerabilityEPSS 0.4%