Fallos del tipo CWE-89

12.013 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-36873LOWSourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_admin.php.EPSS 0.2%CVE-2025-52637MEDIUMMultiple security vulnerabilities affect HCL AIONEPSS 0.2%CVE-2026-36920LOWSourcecodester Online Reviewer System v1.0 is vulnerable to SQL Injection in the file /system/system/admins/assessments/examproper/questionsEPSS 0.2%CVE-2026-32458HIGHWordPress WOLF plugin <= 1.0.8.7 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-56052HIGHWordPress Funnel Builder by FunnelKit plugin <= 3.15.0.5 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-33723HIGHAVideo Vulnerable to SQL Injection in Subscribe Endpoint via Unsanitized user_id Parameter in subscribe.phpEPSS 0.2%CVE-2021-47872HIGHSEO Panel < 4.9.0 - 'order_col' Blind SQL InjectionEPSS 0.2%CVE-2026-44744MEDIUMSQL Injection vulnerability in SAP S/4HANAEPSS 0.2%CVE-2026-6225MEDIUMTaskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.6 - Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project_search' ParameterEPSS 0.2%CVE-2026-4776HIGHAn SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested querEPSS 0.2%CVE-2023-45256MEDIUMMultiple SQL injection vulnerabilities in the EuroInformation MoneticoPaiement module before 1.1.1 for PrestaShop allow remote attackers to EPSS 0.2%CVE-2026-40834HIGHAuthenticated SQLi in saveDashboardLayout functionEPSS 0.2%CVE-2026-45214HIGHWordPress Xpro Elementor Addons plugin <= 1.5.1 - SQL Injection vulnerabilityEPSS 0.2%CVE-2025-40888MEDIUMAuthenticated SQL Injection on CLI functionality in Guardian/CMC before 25.3.0EPSS 0.2%CVE-2026-42741HIGHWordPress Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend plugin <= 3.3.2 - SQL Injection vulnerabilityEPSS 0.2%CVE-2025-40885MEDIUMAuthenticated SQL Injection on Smart Polling functionality in Guardian/CMC before 25.2.0EPSS 0.2%CVE-2026-42742HIGHWordPress Views for WPForms plugin <= 3.4.6 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-40833HIGHAuthenticated SQLi in saveDashboardLayout functionEPSS 0.2%CVE-2026-40836HIGHAuthenticated SQLi in inmessage modelEPSS 0.2%CVE-2026-45211HIGHWordPress APIExperts Square for WooCommerce plugin <= 4.7.1 - SQL Injection vulnerabilityEPSS 0.2%