Fallos del tipo CWE-89

11.984 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-14230MEDIUMcode-projects Daily Time Recording System add_payroll.php sql injectionEPSS 0.3%CVE-2025-10048MEDIUMMy Auctions Allegro Plugin <= 3.6.31 - Authenticated (Admin+) SQL InjectionEPSS 0.3%CVE-2022-41680HIGHSQL Injection in Forma LMSEPSS 0.3%CVE-2019-25713HIGHMyT-PM 1.5.1 SQL Injection via Charge[group_total] ParameterEPSS 0.3%CVE-2015-10146MEDIUMThumbnail Slider With Lightbox <= 1.0.4 - Authenticated (Admin+) SQL InjectionEPSS 0.3%CVE-2020-37243HIGHWordPress Plugin Supsystic Pricing Table 1.8.7 SQL Injection XSSEPSS 0.3%CVE-2025-48735MEDIUMA SQL Injection issue in the request body processing in BOS IPCs with firmware 21.45.8.2.2_220219 before 21.45.8.2.3_230220 allows remote atEPSS 0.3%CVE-2025-52722CRITICALWordPress Classiera theme <= 4.0.34 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-49452CRITICALWordPress PostaPanduri plugin <= 2.1.3 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-52832CRITICALWordPress NGG Smart Image Search plugin <= 3.4.1 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-39403HIGHWordPress WPAMS plugin <= 44.0 (17-08-2023) - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-25877LOWA vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /admin.php. The attaEPSS 0.3%CVE-2025-52833CRITICALWordPress LMS theme <= 9.2 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-11489MEDIUMcode-projects Online Music Site AdminDeleteAlbum.php sql injectionEPSS 0.3%CVE-2025-48278HIGHWordPress RSVPMarker plugin <= 11.5.6 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-52834CRITICALWordPress Homey theme <= 2.4.7 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-52829CRITICALWordPress DirectIQ Email Marketing plugin <= 2.0 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-11488MEDIUMcode-projects Simple Flight Ticket Booking System POST Parameter checkUser.php sql injectionEPSS 0.3%CVE-2025-47575HIGHWordPress School Management plugin <= 92.0.0 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-60514MEDIUMTillywork v0.1.3 and below is vulnerable to SQL Injection in app/common/helpers/query.builder.helper.ts.EPSS 0.3%