Fallos del tipo CWE-89

12.013 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-30058MEDIUMSQL injection in getPatientIdentifier function of PatientService.plEPSS 0.2%CVE-2025-26392MEDIUMSolarWinds Observability Self-Hosted SQL Injection VulnerabilityEPSS 0.2%CVE-2026-26001HIGHGLPI Inventory Plugin has SQL Injection on dropdown_calendar ReportEPSS 0.2%CVE-2025-30059MEDIUMAuthenticated SQL injection in PrepareCDExportJSON.plEPSS 0.2%CVE-2026-35588MEDIUMGlances has CQL Injection in its Cassandra Export Module via Unsanitized Config ValuesEPSS 0.2%CVE-2025-30060MEDIUMSQL injection in ReturnUserUnitsXML.pl via the UserID parameterEPSS 0.2%CVE-2025-30061MEDIUMSQL injection in utils/Reporter/OpenReportWindow.pl via the UserID parameterEPSS 0.2%CVE-2026-6093MEDIUMCorteza 2024.9.8 - SQL Injection in MSSQL JSON-path meta filter via incorrect T-SQL string escapingEPSS 0.2%CVE-2026-40546HIGHMultiple SQL Injections in SOPlanningEPSS 0.2%CVE-2026-24552HIGHWordPress Create by Mediavine plugin <= 2.5.3 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-2409CRITICALImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delinea Cloud Suite allows Argument InEPSS 0.2%CVE-2022-20518MEDIUMIn query of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead to local information EPSS 0.2%CVE-2024-57459HIGHA time-based SQL injection vulnerability exists in mydetailsstudent.php in the CloudClassroom PHP Project 1.0. The myds parameter does not pEPSS 0.2%CVE-2022-20517MEDIUMIn getMessagesByPhoneNumber of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead toEPSS 0.2%CVE-2026-25405HIGHWordPress eRoom plugin <= 1.7.1 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-3957MEDIUMxierongwkhd weimai-wetapp Endpoint HomeController.java getLikeMovieList sql injectionEPSS 0.2%CVE-2023-7331MEDIUMPKrystian Full-Stack-Bank User sql injectionEPSS 0.2%CVE-2026-13569MEDIUMweng-xianhu EyouCMS API index.php sql injectionEPSS 0.2%CVE-2026-37346MEDIUMSourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_account.php?emp_id=.EPSS 0.2%CVE-2025-45021MEDIUMA SQL Injection vulnerability was identified in the admin/edit-directory.php file of the PHPGurukul Directory Management System v2.0. AttackEPSS 0.2%