Fallos del tipo CWE-89

13.329 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2019-25522HIGHXooGallery Lastest Latest Multiple SQL Injections via photo.phpEPSS 0.4%CVE-2026-1473CRITICALOut-of-band SQL injection in Quatuor Performance EvaluationEPSS 0.4%CVE-2026-1477CRITICALOut-of-band SQL injection in Quatuor Performance EvaluationEPSS 0.4%CVE-2026-1480CRITICALOut-of-band SQL injection in Quatuor Performance EvaluationEPSS 0.4%CVE-2026-1483CRITICALOut-of-band SQL injection in Quatuor Performance EvaluationEPSS 0.4%CVE-2025-2351MEDIUMDayCloud StudentManage Login Endpoint adminScoreUrl sql injectionEPSS 0.4%CVE-2026-1482CRITICALOut-of-band SQL injection in Quatuor Performance EvaluationEPSS 0.4%CVE-2026-1474CRITICALOut-of-band SQL injection in Quatuor Performance EvaluationEPSS 0.4%CVE-2025-6184HIGHTutor LMS Pro – eLearning and online course solution <= 3.7.0 - Authenticated (Tutor Instructor+) SQL InjectionEPSS 0.4%CVE-2026-1479CRITICALOut-of-band SQL injection in Quatuor Performance EvaluationEPSS 0.4%CVE-2026-7253MEDIUMIBM Sterling File Gateway SQL InjectionEPSS 0.4%CVE-2025-64280CRITICALA SQL Injection Vulnerability in CentralSquare Community Development 19.5.7 allows attackers to inject SQL via the permit_no field.EPSS 0.4%CVE-2026-72609HIGHKoha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.plEPSS 0.4%CVE-2025-58788HIGHWordPress License Manager for WooCommerce Plugin <= 3.0.12 - SQL Injection VulnerabilityEPSS 0.4%CVE-2023-26452HIGHRequests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this EPSS 0.4%CVE-2026-46370MEDIUMFleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpointEPSS 0.4%CVE-2026-81626HIGHIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.4%CVE-2026-2094HIGHFlowring｜Docpedia - SQL InjectionEPSS 0.4%CVE-2026-46371MEDIUMFleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpointEPSS 0.4%CVE-2019-25538HIGH202CMS v10 beta SQL Injection via log_user ParameterEPSS 0.4%