Fallos del tipo CWE-89

13.331 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2019-25581HIGHi-doit CMDB 1.12 SQL Injection via objGroupID ParameterEPSS 0.4%CVE-2026-57385HIGHWordPress Vitepos plugin <= 3.4.2 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-32471HIGHWordPress ProLancer Element plugin <= 1.4.8 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-57687HIGHWordPress Custom Field Template plugin <= 2.7.8 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-52697HIGHWordPress Taskbuilder plugin <= 5.0.7 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-42730HIGHWordPress MasterStudy LMS plugin <= 3.7.29 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-57810HIGHWordPress APIExperts Square for WooCommerce plugin <= 4.7.4 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-65526HIGHWordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-32466HIGHWordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-24552HIGHWordPress Create by Mediavine plugin <= 2.5.3 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-65569HIGHWordPress WP Job Portal plugin <= 2.5.6 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-66430HIGHWordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-81287HIGHWordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-59551HIGHWordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerabilityEPSS 0.4%CVE-2025-10310MEDIUMRich Snippet Site Report <= 2.0.0105 - Authenticated (Admin+) SQL InjectionEPSS 0.4%CVE-2026-28002HIGHWordPress Booktics plugin 1.0.22 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-57667HIGHWordPress Groundhogg plugin <= 4.5 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-49073HIGHWordPress Directorist Booking plugin <= 3.0.3 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-27039HIGHWordPress WZone plugin <= 14.0.31 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-57787HIGHWordPress CWS SVGicons plugin <= 1.5.5 - SQL Injection vulnerabilityEPSS 0.4%