Fallos del tipo CWE-89

12.012 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-54809CRITICALWordPress GIFT4U plugin <= 1.0.10 - SQL Injection vulnerabilityEPSS 0.2%CVE-2025-49870HIGHWordPress Paid Member Subscriptions plugin <= 2.15.1 - SQL Injection VulnerabilityEPSS 0.2%CVE-2025-54396MEDIUMNetwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows SQL Injection. Authenticated users can exploit thiEPSS 0.2%CVE-2025-68865CRITICALWordPress Infility Global plugin <= 2.15.06 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-39574CRITICALWordPress InPost Gallery plugin <= 2.1.4.6 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-6991MEDIUMcolinhacks Zod CUID Data Type regexes.ts sql injectionEPSS 0.2%CVE-2026-7229MEDIUMcode-projects Coaching Management System POST reply.php sql injectionEPSS 0.2%CVE-2025-63512MEDIUMkishan0725 Hospital Management System/ v4 is vulnerable to SQL Injection in admin-panel1.php, specifically in the deleting doctor logic. TheEPSS 0.2%CVE-2026-2663MEDIUMAlixhan xh-admin-backend Database Query query sql injectionEPSS 0.2%CVE-2025-50565MEDIUMDoubo ERP 1.0 has an SQL injection vulnerability due to a lack of filtering of user input, which can be remotely initiated by an attacker.EPSS 0.2%CVE-2019-25440HIGHWebIncorp ERP Every version SQL Injection via product_detail.phpEPSS 0.2%CVE-2019-25443HIGHInventory Webapp SQL Injection via add-item.phpEPSS 0.2%CVE-2018-25167HIGHNet-Billetterie 2.9 SQL Injection via login.inc.phpEPSS 0.2%CVE-2019-25446HIGHDIGIT CENTRIS ERP Every version SQL Injection via datum1 ParameterEPSS 0.2%CVE-2026-47296HIGHMicrosoft SQL Server Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2018-25166HIGHMeneame English Pligg 5.8 SQL Injection via search ParameterEPSS 0.2%CVE-2024-53543MEDIUMNovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL injection vulnerability via the addProject EPSS 0.2%CVE-2025-13208MEDIUMFantasticLBP Hotels Server hotelList.php sql injectionEPSS 0.2%CVE-2025-52327HIGHSQL Injection vulnerability in Restaurant Order System 1.0 allows a local attacker to obtain sensitive information via the payment.php fileEPSS 0.2%CVE-2026-14554MEDIUMCheck & Log Email < 2.0.15 - Admin+ SQL Injection via d and s ParametersEPSS 0.2%