Fallos del tipo CWE-89

12.012 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-15560HIGHSQL Injection in NesterSoft WorkTimeEPSS 0.3%CVE-2026-40762HIGHWordPress WPGraphQL plugin < 2.11.1 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-55065HIGHCWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')EPSS 0.3%CVE-2026-44272HIGHDell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command EPSS 0.3%CVE-2025-15088MEDIUMketr JEPaaS loadPostil postilService.loadPostils sql injectionEPSS 0.3%CVE-2026-10296MEDIUMitsourcecode Fees Management System ajax.php sql injectionEPSS 0.3%CVE-2025-52050MEDIUMIn Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext/accounts/doctype/loyalty_program/loyalty_prograEPSS 0.3%CVE-2026-32176MEDIUMSQL Server Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-7264MEDIUMSourceCodester Pizzafy Ecommerce System ajax.php get_cart_items sql injectionEPSS 0.3%CVE-2026-44271HIGHDell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command EPSS 0.3%CVE-2026-8125MEDIUMcode-projects Simple Chat System sendMessage.php sql injectionEPSS 0.3%CVE-2026-22743HIGHServer-Side Request Forgery via Filter Expression Keys in Neo4jVectorStoreEPSS 0.3%CVE-2025-60783MEDIUMThere is a SQL injection vulnerability in Restaurant Management System DBMS Project v1.0 via login.php. The vulnerability allows attackers tEPSS 0.3%CVE-2026-4966MEDIUMitsourcecode Free Hotel Reservation System index.php sql injectionEPSS 0.3%CVE-2026-12131MEDIUMCodeAstro Human Resource Management System Payroll Invoice Payroll.php sql injectionEPSS 0.3%CVE-2026-4569MEDIUMSourceCodester Sales and Inventory System HTTP POST Request view_category.php sql injectionEPSS 0.3%CVE-2022-41671HIGHA CWE-89: Improper Neutralization of Special Elements used in SQL Command (‘SQL Injection’) vulnerability exists that allows adversaries witEPSS 0.3%CVE-2026-9617MEDIUMPostgreSQL Anonymizer: malicious column name allows SQL injection via anon.k_anonymity() functionEPSS 0.3%CVE-2026-10242MEDIUMitsourcecode Content Management System instructions.php sql injectionEPSS 0.3%CVE-2026-38930MEDIUMOpenRapid RapidCMS v1.3.1 was discovered to contain an authentication bypass in the /template/default/menu.php component. This vulnerabilityEPSS 0.3%