Fallos del tipo CWE-89

12.012 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2023-42241LOWAn issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiEPSS 0.2%CVE-2026-57831HIGHJoomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10.11.2EPSS 0.2%CVE-2018-25173HIGHRmedia SMS 1.0 SQL Injection via editgrp.phpEPSS 0.2%CVE-2019-25507HIGHAshop Shopping Cart Software Lastest SQL Injection via index.phpEPSS 0.2%CVE-2023-42237LOWAn issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiEPSS 0.2%CVE-2025-50928MEDIUMEasy Hosting Control Panel EHCP v20.04.1.b was discovered to contain a SQL injection vulnerability via the id parameter in the Change SettinEPSS 0.2%CVE-2019-25504HIGHNCrypted Jobgator Lastest SQL Injection via agents Find-JobsEPSS 0.2%CVE-2026-63080HIGHAptabase SQL Injection via ClickHouse query backendEPSS 0.2%CVE-2018-25182HIGHSilurus Classifieds Script 2.0 SQL Injection via wcategory.phpEPSS 0.2%CVE-2026-65761CRITICALJoomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1EPSS 0.2%CVE-2018-25179HIGHGumbo CMS 0.99 SQL Injection via settings endpointEPSS 0.2%CVE-2025-6753MEDIUMhuija bicycleSharingServer AdminController.java selectAdminByNameLike sql injectionEPSS 0.2%CVE-2018-25189HIGHData Center Audit 2.6.2 SQL Injection via username ParameterEPSS 0.2%CVE-2021-47954HIGHLayerBB 1.1.4 SQL Injection via search_query ParameterEPSS 0.2%CVE-2023-42240LOWAn issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiEPSS 0.2%CVE-2026-58078HIGHJoomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1EPSS 0.2%CVE-2024-35357MEDIUMA vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the EPSS 0.2%CVE-2026-59538CRITICALWordPress GamiPress plugin <= 7.9.7 - SQL Injection vulnerabilityEPSS 0.2%CVE-2024-11025MEDIUMSMA: SQL injection in Sunny Central UPEPSS 0.2%CVE-2026-59526CRITICALWordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerabilityEPSS 0.2%