Fallos del tipo CWE-89

12.004 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-15344MEDIUMTanium addressed a SQL injection vulnerability in Asset.EPSS 0.3%CVE-2026-3767MEDIUMitsourcecode sanitize or validate this input teacher-attendance.php sql injectionEPSS 0.3%CVE-2026-3150MEDIUMitsourcecode College Management System display-teacher.php sql injectionEPSS 0.3%CVE-2026-7199MEDIUMSourceCodester Pharmacy Sales and Inventory System ajax.php sql injectionEPSS 0.3%CVE-2025-12812MEDIUMCloud Suite and Privilege Access Service – SQL InjectionEPSS 0.3%CVE-2025-3751HIGHTIBCO ActiveMatrix BusinessWorks SQL Injection VulnerabilityEPSS 0.3%CVE-2026-41490HIGHDagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager IntegrationsEPSS 0.3%CVE-2019-25519HIGHJettweb PHP Hazir Haber Sitesi Scripti V1 SQL InjectionEPSS 0.3%CVE-2026-45800HIGHVvveb: Authenticated SQL injection in /user/orders via order_by and directionEPSS 0.3%CVE-2025-4510MEDIUMChangjietong UFIDA CRM optntyday.php sql injectionEPSS 0.3%CVE-2025-15140MEDIUMsaiftheboss7 onlinemcqexam quesadd.php sql injectionEPSS 0.3%CVE-2025-13922MEDIUMTag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL Injection via ORDER BY ClauseEPSS 0.3%CVE-2025-26241MEDIUMA SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket <=1.17.5 allows authenticated attackers to exeEPSS 0.3%CVE-2024-33407MEDIUMSQL injection vulnerability in /model/delete_record.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execEPSS 0.3%CVE-2026-41478CRITICALSaltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)EPSS 0.3%CVE-2025-67987HIGHWordPress Quiz And Survey Master plugin <= 10.3.1 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-25088MEDIUMAn improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6EPSS 0.3%CVE-2025-10870CRITICALSQL injection in DIAL's CentrosNetEPSS 0.3%CVE-2026-22044MEDIUMGLPI is Vulnerable to Authenticated SQL InjectionEPSS 0.3%CVE-2020-37005HIGHTimeClock Software 1.01 Authenticated Time-Based SQL InjectionEPSS 0.3%