Fallos del tipo CWE-89

12.012 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-60109HIGHWordPress LambertGroup - AllInOne - Content Slider Plugin <= 3.8 - SQL Injection VulnerabilityEPSS 0.2%CVE-2025-52047MEDIUMIn Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allowsEPSS 0.2%CVE-2026-44521HIGHelFinder: SQL Injection MySQL Volume Driver (elFinderVolumeMySQL)EPSS 0.2%CVE-2026-59515CRITICALWordPress AIWU plugin <= 1.5.4 - SQL Injection vulnerabilityEPSS 0.2%CVE-2025-60108HIGHWordPress LambertGroup - AllInOne - Banner with Thumbnails Plugin <= 3.8 - SQL Injection VulnerabilityEPSS 0.2%CVE-2026-39531CRITICALWordPress WP Directory Kit plugin <= 1.5.0 - SQL Injection vulnerabilityEPSS 0.2%CVE-2025-60107HIGHWordPress LambertGroup - AllInOne - Banner with Playlist Plugin <= 3.8 - SQL Injection VulnerabilityEPSS 0.2%CVE-2025-58686HIGHWordPress Perfect Brands for WooCommerce plugin <= 3.6.2 - SQL Injection vulnerabilityEPSS 0.2%CVE-2025-40698HIGHSQL injection vulnerability in PrevengosEPSS 0.2%CVE-2026-22821MEDIUMmreporting affected by a SQLI on date changeEPSS 0.2%CVE-2026-1317MEDIUMWP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File NameEPSS 0.2%CVE-2026-15104MEDIUMBetterDocs <= 4.6.0 - Authenticated (Custom+) SQL Injection via 'lang' ParameterEPSS 0.2%CVE-2026-15073MEDIUMKiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionControllerEPSS 0.2%CVE-2026-4173MEDIUMCodePhiliaX Chat2DB Database Export DMDBManage.java updateProcedure sql injectionEPSS 0.2%CVE-2025-29267MEDIUMSQL Injection vulnerability in Abis, Inc Adjutant Core Accounting ERP build v.PreBeta250F allows a remote attacker to obtain a sensitive infEPSS 0.2%CVE-2025-14153MEDIUMPage Expire Popup/Redirection for WordPress <= 1.0 - Authenticated (Author+) SQL Injection via 'id' Shortcode AttributeEPSS 0.2%CVE-2025-30633CRITICALWordPress Amazon Native Shopping Recommendations Plugin <= 1.3 - SQL Injection VulnerabilityEPSS 0.2%CVE-2026-2503MEDIUMElementCamp <= 2.3.6 - Authenticated (Author+) SQL Injection via 'meta_query[compare]' ParameterEPSS 0.2%CVE-2025-50868MEDIUMA SQL Injection vulnerability exists in the takeassessment2.php file of CloudClassroom-PHP-Project 1.0. The Q4 POST parameter is not properlEPSS 0.2%CVE-2026-7783MEDIUMCodeCanyon Perfex CRM Admin Kanban Endpoint AbstractKanban.php applySortQuery sql injectionEPSS 0.2%