Fallos del tipo CWE-89

12.012 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-40825HIGHAuthenticated SQLi in accountstatus viewEPSS 0.2%CVE-2025-5782MEDIUMPHPGurukul Employee Record Management System resetpassword.php sql injectionEPSS 0.2%CVE-2025-55476MEDIUMFireShare FileShare 1.2.25 contains a time-based blind SQL injection vulnerability in the sort parameter of the endpoint: GET /api/videos/puEPSS 0.2%CVE-2026-46446HIGHSOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_passwEPSS 0.2%CVE-2026-46445HIGHSOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.EPSS 0.2%CVE-2021-47766HIGHKmaleon 1.1.0.205 - 'tipocomb' SQL Injection (Authenticated)EPSS 0.2%CVE-2026-37598LOWSourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to arbitrary code execution (RCE) via /scheduler/classes/SystemSettinEPSS 0.2%CVE-2025-25228LOWExtension - virtuemart.net - SQL injection in VirtueMart component 1.0.0 - 4.4.7 for JoomlaEPSS 0.2%CVE-2026-40823HIGHAuthenticated SQLi in DevSerialReset functionEPSS 0.2%CVE-2025-41029CRITICALSQL injection in Zeon Academy Pro by Zeon Global TechEPSS 0.2%CVE-2025-66095HIGHWordPress KiviCare plugin <= 3.6.13 - SQL Injection vulnerabilityEPSS 0.2%CVE-2024-37848HIGHSQL Injection vulnerability in Online-Bookstore-Project-In-PHP v1.0 allows a local attacker to execute arbitrary code via the admin_delete.pEPSS 0.2%CVE-2018-25197HIGHPlayJoom 0.10.1 SQL Injection via catid ParameterEPSS 0.2%CVE-2018-25173HIGHRmedia SMS 1.0 SQL Injection via editgrp.phpEPSS 0.2%CVE-2026-58078HIGHJoomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1EPSS 0.2%CVE-2023-42237LOWAn issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiEPSS 0.2%CVE-2024-35357MEDIUMA vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the EPSS 0.2%CVE-2023-42240LOWAn issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiEPSS 0.2%CVE-2025-6738MEDIUMhuija bicycleSharingServer UserServiceImpl.java userDao.selectUserByUserNameLike sql injectionEPSS 0.2%CVE-2021-47954HIGHLayerBB 1.1.4 SQL Injection via search_query ParameterEPSS 0.2%