Fallos del tipo CWE-89

13.331 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-28168HIGHWordPress CubeWP plugin <= 1.1.30 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-66658HIGHWordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-65547HIGHWordPress Creative Mail plugin <= 1.6.9 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-57765HIGHWordPress WP EasyCart plugin <= 5.9.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-25405HIGHWordPress eRoom plugin <= 1.7.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-32550HIGHWordPress Kadence Shop Kit plugin <= 3.0.6 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-57653HIGHWordPress WP Job Portal plugin <= 2.5.2 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-54185HIGHWordPress Cornerstone plugin < 7.8.8 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-78285HIGHWordPress Like Button Rating plugin <= 2.6.61 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-32516HIGHWordPress Miraculous Core Plugin plugin < 2.1.2 - SQL Injection vulnerabilityEPSS 0.4%CVE-2025-5388MEDIUMJeeWMS generateController.do dogenerate sql injectionEPSS 0.4%CVE-2026-57642HIGHWordPress Gallery plugin <= 4.7.8 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-81277HIGHWordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerabilityEPSS 0.4%CVE-2025-70397HIGHjizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the data parameter.EPSS 0.4%CVE-2025-8587HIGHTime-Based Blind SQLi in AKCE Software's SKSProEPSS 0.4%CVE-2026-49046HIGHWordPress Duplicate Page and Post plugin <= 2.9.5 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-42742HIGHWordPress Views for WPForms plugin <= 3.4.6 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-57810HIGHWordPress APIExperts Square for WooCommerce plugin <= 4.7.4 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-65451HIGHWordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-66668HIGHWordPress Community by PeepSo plugin <= 9.0.5.2 - SQL Injection vulnerabilityEPSS 0.4%