Fallos del tipo CWE-89

12.012 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-44660MEDIUMPHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the fullname, emailid, and contactno parameters in login.php.EPSS 0.2%CVE-2024-44640MEDIUMPHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the course-short, course-full, and cdate parameters in add-course.pEPSS 0.2%CVE-2024-40068MEDIUMSourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at id_generator/aEPSS 0.2%CVE-2024-44633MEDIUMPHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the currentpassword parameter in change-password.php.EPSS 0.2%CVE-2026-39946MEDIUMOpenBao allows SQL Injection in PostgreSQL database secrets engineEPSS 0.2%CVE-2024-44644MEDIUMPHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the frm_id and aremark parameters in manage-tickets.php.EPSS 0.2%CVE-2026-21892MEDIUMParsl Monitoring Visualization Vulnerable to SQL InjectionEPSS 0.2%CVE-2024-44653MEDIUMKashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the user_email parameter in user_login.php.EPSS 0.2%CVE-2024-44663MEDIUMPHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the product parameter in search-result.php.EPSS 0.2%CVE-2021-35484HIGHNokia IMPACT through 19.11.2.10-20210118042150283 allows an authenticated user to perform a Time-based Boolean Blind SQL Injection attack onEPSS 0.2%CVE-2024-44654MEDIUMPHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the email and mobileno parameters in reset-password.php.EPSS 0.2%CVE-2025-63878MEDIUMGithub Restaurant Website Restoran v1.0 was discovered to contain a SQL injection vulnerability via the Contact Form page.EPSS 0.2%CVE-2024-44641MEDIUMPHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the oldpass parameter in change-password.php.EPSS 0.2%CVE-2024-44630MEDIUMMultiple parameters in register.php in PHPGurukul Student Record System 3.20 are vulnerable to SQL injection. These include: c-full, fname, EPSS 0.2%CVE-2018-25165HIGHGalaxy Forces MMORPG 0.5.8 SQL Injection via ads.phpEPSS 0.2%CVE-2024-44652MEDIUMKashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the user_email, username, user_firstname, user_lastname, and user_addressEPSS 0.2%CVE-2024-44657MEDIUMPHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the fromdate and todate parameters in between-date-userreport.EPSS 0.2%CVE-2024-44664MEDIUMPHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the name, summary, review, quality, price, and value parameters in EPSS 0.2%CVE-2024-44651MEDIUMKashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the recover_email parameter in user_password_recover.php.EPSS 0.2%CVE-2026-2508MEDIUMGravity Forms Booking <= 2.7.1 - Authenticated (Subscriber+) Time-Based SQL Injection via 'staff_id'EPSS 0.2%