Fallos del tipo CWE-89

13.302 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-32551CRITICALWordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-28001CRITICALWordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-49067CRITICALWordPress Advanced 301 and 302 Redirect plugin <= 1.6.9 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-61950CRITICALWordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-57683CRITICALWordPress WP Fast Total Search plugin <= 1.80.280 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-54849CRITICALWordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.11 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-73391CRITICALWordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-42665CRITICALWordPress WP Data Access plugin <= 5.5.70 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-32554CRITICALWordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerabilityEPSS 0.4%CVE-2024-34992HIGHSQL Injection vulnerability in the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules fEPSS 0.4%CVE-2026-66593CRITICALWordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-48886CRITICALWordPress JS Help Desk plugin <= 3.0.9 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-42672CRITICALWordPress WP Directory Kit plugin <= 1.5.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2025-7482MEDIUMPHPGurukul Vehicle Parking Management System print.php sql injectionEPSS 0.4%CVE-2023-42807MEDIUMFrappe LMS SQL Injection Issue on People PageEPSS 0.4%CVE-2024-13844MEDIUMPost SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns ParameterEPSS 0.4%CVE-2026-39229MEDIUMBolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages. An authenticated attacker with low-level EPSS 0.4%CVE-2026-2508MEDIUMGravity Forms Booking <= 2.7.1 - Authenticated (Subscriber+) Time-Based SQL Injection via 'staff_id'EPSS 0.4%CVE-2026-10105HIGHagno 2.6.5 SQL Injection via ClickHouse delete_by_metadata()EPSS 0.4%CVE-2025-69216HIGHOpenSTAManager has an SQL Injection in Scadenzario Print TemplateEPSS 0.4%