Fallos del tipo CWE-89

12.006 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-59008HIGHWordPress ZIP Code Based Content Protection plugin <= 1.0.0 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-56699MEDIUMSQL injection vulnerability in the cmd component of Base Digitale Group spa product Centrax Open PSIM version 6.1 allows an unauthenticated EPSS 0.3%CVE-2026-13454MEDIUMMotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' ParameterEPSS 0.3%CVE-2025-64366HIGHWordPress MasterStudy LMS plugin <= 3.6.27 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-49033HIGHWordPress ProfileGrid plugin <= 5.9.5.3 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-63724MEDIUMSQL injection (SQL-i) vulnerability in SVX Portal 2.7A via crafted POST request to admin/update_setings.php.EPSS 0.3%CVE-2025-49485HIGHExtension - balbooa.com - SQL injection in Balbooa Forms component version 1.0.0 - 2.3.1.1 for JoomlaEPSS 0.3%CVE-2025-52820HIGHWordPress WooCommerce Point Of Sale (POS) <= 1.4 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-13011MEDIUMERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support <= 1.17.5 - Authenticated (HR Manager+) SQL Injection via 'orderby' ParameterEPSS 0.3%CVE-2026-8297CRITICALSQLi in GIS Informatics' GisLab Laboratory Management SystemEPSS 0.3%CVE-2026-27373HIGHWordPress Tablesome plugin <= 1.2.3 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-67404CRITICALSourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud.php via the parameters fname, lname, and stEPSS 0.3%CVE-2026-60582HIGHVulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported versioEPSS 0.3%CVE-2025-67829CRITICALMura before 10.1.14 allows beanFeed.cfc getQuery sortDirection SQL injection.EPSS 0.3%CVE-2026-65454HIGHWordPress Quiz And Survey Master plugin <= 11.2.0 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-35614CRITICALFrappe has a SQL injection in bulk_updateEPSS 0.3%CVE-2026-27428HIGHWordPress Eagle Booking plugin <= 1.3.4.3 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-12329MEDIUMshawon100 RUET OJ details.php sql injectionEPSS 0.3%CVE-2025-67403CRITICALSourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_class.php via the parameter class_name.EPSS 0.3%CVE-2026-65450HIGHWordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerabilityEPSS 0.3%