Fallos del tipo CWE-89

12.846 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2021-24847—SEO Redirection < 8.2 - Subscriber+ SQL InjectionEPSS 1.4%CVE-2021-24829—Visitor Traffic Real Time Statistics < 3.9 - Subscriber+ SQL InjectionEPSS 1.4%CVE-2022-40043HIGHCentreon v20.10.18 was discovered to contain a SQL injection vulnerability via the esc_name (Escalation Name) parameter at Configuration/NotEPSS 1.4%CVE-2024-23119HIGHCentreon insertGraphTemplate SQL Injection Remote Code Execution VulnerabilityEPSS 1.4%CVE-2021-25030—Events Made Easy < 2.2.36 - Subscriber+ SQL InjectionEPSS 1.4%CVE-2023-51951CRITICALSQL Injection vulnerability in Stock Management System 1.0 allows a remote attacker to execute arbitrary code via the id parameter in the maEPSS 1.4%CVE-2020-36073HIGHSQL injection vulnerability found in Tailor Management System v.1 allows a remote attacker to execute arbitrary code via the detail parameteEPSS 1.3%CVE-2021-36722HIGHEmuse - eServices / eNvoice SQL injectionEPSS 1.3%CVE-2007-2534CRITICALMultiple SQL injection vulnerabilities in admin.php in phpHoo3 allow remote attackers to execute arbitrary SQL commands via the (1) ADMIN_USEPSS 1.3%CVE-2021-21380HIGHRating Script Service expose XWiki to SQL injectionEPSS 1.3%CVE-2021-24957—Advanced Page Visit Counter < 6.1.6 - Subscriber+ Blind SQL injectionEPSS 1.3%CVE-2020-25700—In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 toEPSS 1.3%CVE-2021-24497—Giveaway <= 1.2.2 - Authenticated SQL InjectionEPSS 1.3%CVE-2021-24484—Secure Copy Content Protection and Content Locking < 2.6.7 - Authenticated Blind SQL InjectionsEPSS 1.3%CVE-2026-54836CRITICALWordPress Filter & Grids plugin <= 3.11.5 - SQL Injection vulnerabilityEPSS 1.3%CVE-2026-42647CRITICALWordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerabilityEPSS 1.3%CVE-2021-24662—Game Server Status <= 1.0 - Admin+ SQL InjectionEPSS 1.3%CVE-2020-20413CRITICALSQL injection vulnerability found in WUZHICMS v.4.1.0 allows a remote attacker to execute arbitrary code via the checktitle() function in adEPSS 1.3%CVE-2016-10556—sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server iEPSS 1.3%CVE-2021-24200—wpDataTables < 3.4.2 - Blind SQL Injection via length ParameterEPSS 1.3%