Fallos del tipo CWE-89

12.012 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-59533CRITICALWordPress Relevanssi Light plugin <= 1.2.2 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-59549CRITICALWordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerabilityEPSS 0.2%CVE-2024-11025MEDIUMSMA: SQL injection in Sunny Central UPEPSS 0.2%CVE-2026-59550CRITICALWordPress AWP Classifieds plugin <= 4.4.7 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-42755CRITICALWordPress TableOn plugin <= 1.0.5.1 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-59525CRITICALWordPress Participants Database plugin <= 2.7.8.3 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-42672CRITICALWordPress WP Directory Kit plugin <= 1.5.1 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-59538CRITICALWordPress GamiPress plugin <= 7.9.7 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-40745HIGHWordPress Element Pack Elementor Addons plugin <= 8.4.2 - SQL Injection vulnerabilityEPSS 0.2%CVE-2024-44648MEDIUMPHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via id and adminremark parameters in quote-details.php.EPSS 0.2%CVE-2026-57955HIGHSigNoz 0.130.1 - SQL Injection in Alert History Endpoints via Rule ID ParameterEPSS 0.2%CVE-2024-44658MEDIUMPHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the subcategory and category parameters in subcategory.php.EPSS 0.2%CVE-2024-44639MEDIUMPHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the sub1, sub2, sub3, sub4, and course-short parameters in add-subjEPSS 0.2%CVE-2024-44662MEDIUMPHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the username parameter in the admin page.EPSS 0.2%CVE-2024-44632MEDIUMPHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the id and emailid parameters in password-recovery.php.EPSS 0.2%CVE-2023-42243MEDIUMIn Selesta Visual Access Manager < 4.42.2, an authenticated user can access the administrative page /common/vam_Sql.php, which allows for arEPSS 0.2%CVE-2024-55016MEDIUMPHPGurukul Student Record Management System 3.20 is vulnerable to SQL Injection via the id and password parameters in login.php.EPSS 0.2%CVE-2025-68561HIGHWordPress AutomatorWP plugin <= 5.2.4 - SQL Injection vulnerabilityEPSS 0.2%CVE-2025-11663MEDIUMCampcodes Online Beauty Parlor Management System manage-services.php sql injectionEPSS 0.2%CVE-2025-63718MEDIUMA SQL injection vulnerability exists in the SourceCodester PQMS (Patient Queue Management System) 1.0 in the api_patient_schedule.php endpoiEPSS 0.2%