Fallos del tipo CWE-89

12.012 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-52715CRITICALWordPress GEO my WordPress plugin <= 4.5.5 - SQL Injection vulnerabilityEPSS 0.2%CVE-2025-58881HIGHWordPress New Simple Gallery Plugin <= 8.0 - SQL Injection VulnerabilityEPSS 0.2%CVE-2025-60109HIGHWordPress LambertGroup - AllInOne - Content Slider Plugin <= 3.8 - SQL Injection VulnerabilityEPSS 0.2%CVE-2025-58686HIGHWordPress Perfect Brands for WooCommerce plugin <= 3.6.2 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-44521HIGHelFinder: SQL Injection MySQL Volume Driver (elFinderVolumeMySQL)EPSS 0.2%CVE-2025-52047MEDIUMIn Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allowsEPSS 0.2%CVE-2025-60108HIGHWordPress LambertGroup - AllInOne - Banner with Thumbnails Plugin <= 3.8 - SQL Injection VulnerabilityEPSS 0.2%CVE-2025-60107HIGHWordPress LambertGroup - AllInOne - Banner with Playlist Plugin <= 3.8 - SQL Injection VulnerabilityEPSS 0.2%CVE-2026-59515CRITICALWordPress AIWU plugin <= 1.5.4 - SQL Injection vulnerabilityEPSS 0.2%CVE-2025-52043MEDIUMIn Frappe ERPNext v15.57.5, the function import_coa() at erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.py iEPSS 0.2%CVE-2025-56075MEDIUMA SQL Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System vEPSS 0.2%CVE-2025-60110HIGHWordPress AllInOne - Banner Rotator Plugin <= 3.8 - SQL Injection VulnerabilityEPSS 0.2%CVE-2026-39531CRITICALWordPress WP Directory Kit plugin <= 1.5.0 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-2176MEDIUMcode-projects Contact Management System index.py sql injectionEPSS 0.2%CVE-2025-30633CRITICALWordPress Amazon Native Shopping Recommendations Plugin <= 1.3 - SQL Injection VulnerabilityEPSS 0.2%CVE-2026-22821MEDIUMmreporting affected by a SQLI on date changeEPSS 0.2%CVE-2026-15073MEDIUMKiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionControllerEPSS 0.2%CVE-2025-40698HIGHSQL injection vulnerability in PrevengosEPSS 0.2%CVE-2026-2503MEDIUMElementCamp <= 2.3.6 - Authenticated (Author+) SQL Injection via 'meta_query[compare]' ParameterEPSS 0.2%CVE-2026-4173MEDIUMCodePhiliaX Chat2DB Database Export DMDBManage.java updateProcedure sql injectionEPSS 0.2%