Fallos del tipo CWE-89

11.998 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-39357HIGHWordPress Hospital Management System plugin <= 47.0(20-11-2023) - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-31926HIGHWordPress Sticky Radio Player plugin <= 3.4 - SQL Injection VulnerabilityEPSS 0.3%CVE-2019-25641HIGHNetartmedia Vlog System Lastest SQL Injection via email ParameterEPSS 0.3%CVE-2025-52821HIGHWordPress Video List Manager plugin <= 1.7 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-3325CRITICALSQL injection in MegaCMS by CRM Sistemas de FidelizaciónEPSS 0.3%CVE-2019-25642HIGHBootstrapy CMS Lastest Multiple SQL Injection via Forum and Contact ModulesEPSS 0.3%CVE-2026-2122MEDIUMXiaopi Panel WAF Firewall demo.php sql injectionEPSS 0.3%CVE-2026-12987HIGHEvents Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking RegistrationEPSS 0.3%CVE-2025-32287HIGHWordPress Responsive HTML5 Audio Player PRO With Playlist plugin <= 3.5.7 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-32307HIGHWordPress Chameleon HTML5 Audio Player With/Without Playlist plugin <= 3.5.6 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-47651HIGHWordPress Infility Global plugin <= 2.15.06 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-32924HIGHWordPress Revy plugin <= 2.1 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-32301HIGHWordPress CountDown Pro WP Plugin <= 2.7 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-52822HIGHWordPress WP Roadmap plugin <= 2.1.3 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-15736HIGHMultiple SQL/DDL Injection and Arbitrary File Read Vulnerabilities in snowflake-sqlalchemyEPSS 0.3%CVE-2025-32306HIGHWordPress Radio Player Shoutcast & Icecast theme <= 4.4.6 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-39355HIGHWordPress FAT Services Booking plugin <= 5.6 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-31928HIGHWordPress Multimedia Responsive Carousel with Image Video Audio Support plugin <= 2.6.0 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-5673MEDIUMBlog2Social <= 8.4.4 - Authenticated (Subscriber+) SQL Injection via `prgSortPostType` ParameterEPSS 0.3%CVE-2026-6030MEDIUMitsourcecode Construction Management System del1.php sql injectionEPSS 0.3%