Fallos del tipo CWE-89

12.012 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-39495HIGHWordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-6978MEDIUMJiZhiCMS addcache.html htmlspecialchars_decode sql injectionEPSS 0.3%CVE-2026-25234MEDIUMPEAR is Vulnerable to SQL Injection in Category DeletionEPSS 0.3%CVE-2025-30979HIGHWordPress Pixelating image slideshow gallery plugin <= 8.0 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-24780HIGHWordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.4.0 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-39486HIGHWordPress Rankie plugin < 1.8.2 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-30969HIGHWordPress iFrame Images Gallery plugin <= 9.0 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-28969HIGHWordPress Gallery Widget plugin <= 1.2.1 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-28967HIGHWordPress Contact Us page - Contact people LITE plugin <= 3.7.4 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-63231HIGHPost-authentication SQL injection vulnerabilityEPSS 0.3%CVE-2026-9272HIGHPossibility of unintended database operations when querying data related to detected anomalies in Progress Flowmon ADSEPSS 0.3%CVE-2025-32297HIGHWordPress Simple Link Directory Pro plugin < 14.8.1 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-48118HIGHWordPress Woocommerce Partial Shipment plugin <= 3.2 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-10144MEDIUMPerfect Brands for WooCommerce <= 3.6.2 - Authenticated (Contributor+) SQL InjectionEPSS 0.3%CVE-2025-30947HIGHWordPress Cool fade popup plugin <= 10.1 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-33503HIGHOry Kratos has a SQL injection via forged pagination tokensEPSS 0.3%CVE-2025-10258MEDIUMA time-based SQL Injection vulnerability in Infinera DNAEPSS 0.3%CVE-2018-25175HIGHAlienor Web Libre 2.0 SQL Injection via index.phpEPSS 0.3%CVE-2025-55065HIGHCWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')EPSS 0.3%CVE-2026-40762HIGHWordPress WPGraphQL plugin < 2.11.1 - SQL Injection vulnerabilityEPSS 0.3%