Fallos del tipo CWE-89

13.306 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-5779MEDIUMcode-projects Patient Record Management System birthing.php sql injectionEPSS 0.4%CVE-2026-88395CRITICALGouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.EPSS 0.4%CVE-2024-34222MEDIUMSourcecodester Human Resource Management System 1.0 is vulnerable to SQL Injection via the searccountry parameter.EPSS 0.4%CVE-2019-25479HIGHInout RealEstate Lastest SQL Injection via agentlistdetailsEPSS 0.4%CVE-2025-14068HIGHWPNakama <= 0.6.3 - Unauthenticated SQL Injection via 'order_by' ParameterEPSS 0.4%CVE-2017-20197MEDIUMpropanetank Roommate-Bill-Tracking login.php sql injectionEPSS 0.4%CVE-2025-67962HIGHWordPress Broken Link Checker plugin <= 1.2.6 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-33909MEDIUMOpenEMR Vulnerable to SQL Injection via Unsanitized Variables in MedEx Recall/Reminder ProcessingEPSS 0.4%CVE-2026-101997CRITICALJunos OS: SRX Series: A network-based attacker causes Remote Code Execution when Security Intelligence is used without a tls-profile authenticationEPSS 0.4%CVE-2026-37598LOWSourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to arbitrary code execution (RCE) via /scheduler/classes/SystemSettinEPSS 0.4%CVE-2025-10587CRITICALCommunity Events <= 1.5.1 - Unauthenticated SQL InjectionEPSS 0.4%CVE-2025-10969CRITICALSQLi in Farktor Software's E-Commerce PackageEPSS 0.4%CVE-2026-44739HIGHPimcore: SQL Injection in Custom Reports Column ConfigurationEPSS 0.4%CVE-2026-2232HIGHProduct Table and List Builder for WooCommerce Lite <= 4.6.2 - Unauthenticated Time-Based SQL Injection via 'search' ParameterEPSS 0.4%CVE-2025-10430MEDIUMSourceCodester Pet Grooming Management Software barcode.php sql injectionEPSS 0.4%CVE-2025-3893HIGHSQL Injection in MegaBIPEPSS 0.4%CVE-2024-5236MEDIUMCampcodes Complete Web-Based School Management System teacher_salary_invoice1.php sql injectionEPSS 0.4%CVE-2025-31403CRITICALWordPress Booking Calendar and Notification plugin <= 4.0.3 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-14872MEDIUMDatabase for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id ParameterEPSS 0.4%CVE-2026-15153MEDIUMWP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List SearchEPSS 0.4%