Fallos del tipo CWE-89

13.329 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2019-25538HIGH202CMS v10 beta SQL Injection via log_user ParameterEPSS 0.4%CVE-2026-72609HIGHKoha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.plEPSS 0.4%CVE-2026-31922HIGHWordPress Fox LMS plugin <= 1.0.6.3 - SQL Injection vulnerabilityEPSS 0.4%CVE-2023-26454HIGHRequests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requEPSS 0.4%CVE-2025-6267MEDIUMzhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 barcodeDetail sql injectionEPSS 0.4%CVE-2025-59557CRITICALWordPress Learts Addons Plugin < 1.7.5 - SQL Injection VulnerabilityEPSS 0.4%CVE-2026-7253MEDIUMIBM Sterling File Gateway SQL InjectionEPSS 0.4%CVE-2026-46371MEDIUMFleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpointEPSS 0.4%CVE-2024-56804MEDIUMVideo StationEPSS 0.4%CVE-2026-31917HIGHWordPress WP ERP plugin <= 1.16.10 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-81626HIGHIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.4%CVE-2026-32366HIGHWordPress Collapsing Categories plugin <= 3.0.9 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-32368HIGHWordPress Geo to Lat plugin <= 1.0.19 - SQL Injection vulnerabilityEPSS 0.4%CVE-2025-40755HIGHA vulnerability has been identified in SINEC NMS (All versions < V4.0 SP1). Affected applications are vulnerable to SQL injection through geEPSS 0.4%CVE-2023-26453HIGHRequests to cache an image could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires aEPSS 0.4%CVE-2026-27373HIGHWordPress Tablesome plugin <= 1.2.3 - SQL Injection vulnerabilityEPSS 0.4%CVE-2025-58788HIGHWordPress License Manager for WooCommerce Plugin <= 3.0.12 - SQL Injection VulnerabilityEPSS 0.4%CVE-2025-20272MEDIUMCisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Blind SQL Injection VulnerabilityEPSS 0.4%CVE-2026-18443HIGHSmart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' ParameterEPSS 0.4%CVE-2026-6637HIGHPostgreSQL refint allows stack buffer overflow and SQL injectionEPSS 0.4%