Fallos del tipo CWE-89

12.846 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2023-31939HIGHSQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the costomer_iEPSS 1.3%CVE-2025-10210MEDIUMyanyutao0402 ChanCMS Api.js search sql injectionEPSS 1.3%CVE-2023-27707HIGHSQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dEPSS 1.3%CVE-2023-31940HIGHSQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the page_id paEPSS 1.3%CVE-2023-27709HIGHSQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dEPSS 1.3%CVE-2023-31938HIGHSQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the emp_id parEPSS 1.3%CVE-2023-25196—Apache Fineract: SQL injection vulnerability EPSS 1.3%CVE-2017-6754—A vulnerability in the web-based management interface of the Cisco Smart Net Total Care (SNTC) Software Collector Appliance 3.11 could allowEPSS 1.3%CVE-2021-35048CRITICALUnauthenticated SQL Injection Vulnerability in Fidelis Network and DeceptionEPSS 1.3%CVE-2022-0190—Ad Invalid Click Protector (AICP) < 1.2.6 - Authenticated SQL InjectionEPSS 1.3%CVE-2021-24456—Quiz Maker < 6.2.0.9 - Multiple Authenticated Blind SQL InjectionsEPSS 1.3%CVE-2024-23538CRITICALApache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.EPSS 1.3%CVE-2024-40502CRITICALSQL injection vulnerability in Hospital Management System Project in ASP.Net MVC 1 allows aremote attacker to execute arbitrary code via theEPSS 1.3%CVE-2022-3494HIGHComplianz (Free < 6.3.4, Premium < 6.3.6) - Translator SQLiEPSS 1.3%CVE-2021-25037—All In One SEO < 4.1.5.3 - Authenticated SQL InjectionEPSS 1.3%CVE-2021-26634CRITICALMaxboard multiple vulnerabilitiesEPSS 1.3%CVE-2011-0467HIGHSQL injection in SUSE studio via select parameterEPSS 1.3%CVE-2026-44680HIGHMikroORM: SQL injection via runtime-controlled identifiers and JSON-path keysEPSS 1.3%CVE-2023-52335HIGHAdvantech iView ConfigurationServlet SQL Injection Information Disclosure VulnerabilityEPSS 1.3%CVE-2022-2958—BadgeOS < 3.7.1.3 - Subscriber+ SQLiEPSS 1.3%