Fallos del tipo CWE-89

12.013 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-40744HIGHWordPress Beaver Builder plugin <= 2.10.1.2 - SQL Injection vulnerabilityEPSS 0.2%CVE-2025-68056HIGHWordPress LBG Zoominoutslider plugin <= 5.4.4 - SQL Injection vulnerabilityEPSS 0.2%CVE-2025-64371HIGHWordPress Traveler theme < 3.2.6 - SQL Injection vulnerabilityEPSS 0.2%CVE-2025-30628HIGHWordPress Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) plugin <= 1.2 - SQL Injection VulnerabilityEPSS 0.2%CVE-2023-40992MEDIUMHospital Management System 4 is vulnerable to a SQL injection in /Hospital-Management-System-master/func.php via the password2 parameter.EPSS 0.2%CVE-2025-43923MEDIUMAn issue was discovered in ReportController in Unicom Focal Point 7.6.1. A user who has administrative privilege in Focal Point can perform EPSS 0.2%CVE-2026-48240HIGHOpen ISES Tickets < 3.44.2 SQL Injection via ajax/statistics.php tick_id and f_tick_id ParametersEPSS 0.2%CVE-2025-10095MEDIUMSQL injection in SMPP component of SMSEagle firmwareEPSS 0.2%CVE-2026-33734MEDIUMFOSSBilling has improper SQL neutralization in `Massmailer` recipient filtersEPSS 0.2%CVE-2021-47777HIGHBuild Smart ERP 21.0817 - 'eidValue' SQL Injection (Unauthenticated)EPSS 0.2%CVE-2026-56351MEDIUMn8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL NodesEPSS 0.2%CVE-2025-15477MEDIUMThe Bucketlister <= 0.1.5 - Authenticated (Contributor+) SQL Injection via `category` and `id` Shortcode AttributesEPSS 0.2%CVE-2026-8653MEDIUMMasterStudy LMS Pro Plus <= 4.8.20 - Authenticated (Instructor+) SQL Injection via 'columns' ParameterEPSS 0.2%CVE-2026-24959HIGHWordPress JS Help Desk plugin <= 3.0.1 - SQL Injection vulnerabilityEPSS 0.2%CVE-2025-13431MEDIUMSlimStat Analytics <= 5.3.1 - Authenticated (Subscriber+) SQL Injection via `args` ParameterEPSS 0.2%CVE-2026-12079MEDIUMDokan Pro <= 5.0.4 - Authenticated (Subscriber+) SQL Injection via 'orderby' ParameterEPSS 0.2%CVE-2026-32534HIGHWordPress JS Help Desk plugin <= 3.0.3 - SQL Injection vulnerabilityEPSS 0.2%CVE-2023-32115MEDIUMSQL Injection in Master Data Synchronization (MDS COMPARE TOOL)EPSS 0.2%CVE-2026-45218HIGHWordPress WP Travel plugin <= 11.4.0 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-44337MEDIUMPraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queriesEPSS 0.2%