Fallos del tipo CWE-89

12.012 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-50868MEDIUMA SQL Injection vulnerability exists in the takeassessment2.php file of CloudClassroom-PHP-Project 1.0. The Q4 POST parameter is not properlEPSS 0.2%CVE-2026-1317MEDIUMWP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File NameEPSS 0.2%CVE-2026-15104MEDIUMBetterDocs <= 4.6.0 - Authenticated (Custom+) SQL Injection via 'lang' ParameterEPSS 0.2%CVE-2025-14153MEDIUMPage Expire Popup/Redirection for WordPress <= 1.0 - Authenticated (Author+) SQL Injection via 'id' Shortcode AttributeEPSS 0.2%CVE-2025-29267MEDIUMSQL Injection vulnerability in Abis, Inc Adjutant Core Accounting ERP build v.PreBeta250F allows a remote attacker to obtain a sensitive infEPSS 0.2%CVE-2026-28115CRITICALWordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-39229MEDIUMBolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages. An authenticated attacker with low-level EPSS 0.2%CVE-2025-39484CRITICALWordPress Entrada Theme <= 5.7.7 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-7265MEDIUMSourceCodester Pizzafy Ecommerce System index.php category sql injectionEPSS 0.2%CVE-2026-6982MEDIUMstar7th ShowDoc API Page Sort Endpoint PageController.class.PHP sql injectionEPSS 0.2%CVE-2025-32303CRITICALWordPress WPCHURCH plugin <= 2.7.0 - SQL Injection VulnerabilityEPSS 0.2%CVE-2026-7743MEDIUMCodeAstro Online Classroom studentdetails sql injectionEPSS 0.2%CVE-2026-5028MEDIUMEight Day Week Print Workflow <= 1.2.6 - Authenticated (Subscriber+) SQL Injection via 'title' ParameterEPSS 0.2%CVE-2026-2435MEDIUMASSET-7706EPSS 0.2%CVE-2026-7148MEDIUMCodeAstro Online Classroom addnewfaculty sql injectionEPSS 0.2%CVE-2024-33722MEDIUMSOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[].EPSS 0.2%CVE-2026-7783MEDIUMCodeCanyon Perfex CRM Admin Kanban Endpoint AbstractKanban.php applySortQuery sql injectionEPSS 0.2%CVE-2025-51825MEDIUMJeecgBoot versions from 3.4.3 up to 3.8.0 were found to contain a SQL injection vulnerability in the /jeecg-boot/online/cgreport/head/parseSEPSS 0.2%CVE-2026-7742MEDIUMCodeAstro Online Classroom facultylogin sql injectionEPSS 0.2%CVE-2026-14782MEDIUMBooking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer ImportEPSS 0.2%