Fallos del tipo CWE-89

13.342 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-11454MEDIUMSpecific Content For Mobile – Customize the mobile version without redirections <= 0.5.5 - Authenticated (Contributor+) SQL InjectionEPSS 0.3%CVE-2025-10105MEDIUMyanyutao0402 ChanCMS search sql injectionEPSS 0.3%CVE-2025-10780MEDIUMCodeAstro Simple Pharmacy Management view.php sql injectionEPSS 0.3%CVE-2026-42712HIGHWordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerabilityEPSS 0.3%CVE-2024-7882MEDIUMSQLi in Special Minds' e-CommerceEPSS 0.3%CVE-2018-25434HIGHWP AutoSuggest 0.24 SQL Injection via autosuggest.phpEPSS 0.3%CVE-2025-9150MEDIUMSurbowl dormitory-management-php violation_add.php sql injectionEPSS 0.3%CVE-2025-6717MEDIUMB1.lt for WooCommerce <= 2.2.56 - Authenticated (Subscriber+) SQL InjectionEPSS 0.3%CVE-2026-107375HIGHJHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) ApplicationssortEPSS 0.3%CVE-2018-25433HIGHJoomla JE Photo Gallery 1.1 SQL Injection via categoryidEPSS 0.3%CVE-2025-10003MEDIUMUsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL InjectionEPSS 0.3%CVE-2020-15875MEDIUMAn issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LiEPSS 0.3%CVE-2024-6480MEDIUMSIP Reviews Shortcode for WooCommerce <= 1.2.3 - Authenticated (Contributor+) Cross-Site ScriptingEPSS 0.3%CVE-2026-21630MEDIUMJoomla! Core - [20260302] - SQL injection in com_content articles webservice endpointEPSS 0.3%CVE-2026-82424MEDIUMPHPGurukul Student Information System student_edit1.php sql injectionEPSS 0.3%CVE-2018-25428HIGHParoiciel 11.20 SQL Injection via tRecIdListe ParameterEPSS 0.3%CVE-2025-31466HIGHWordPress Duplicate Page and Post plugin <= 1.0 - SQL Injection VulnerabilityEPSS 0.3%CVE-2024-53364MEDIUMA SQL injection vulnerability was found in PHPGURUKUL Vehicle Parking Management System v1.13 in /users/view-detail.php. This vulnerability EPSS 0.3%CVE-2025-58692HIGHAn improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet ForEPSS 0.3%CVE-2026-19785MEDIUMfrancoisjacquet RosarioSIS Student Medical Medical.inc.php sql injectionEPSS 0.3%