Fallos del tipo CWE-89

12.031 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-37346MEDIUMSourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_account.php?emp_id=.EPSS 0.2%CVE-2026-3957MEDIUMxierongwkhd weimai-wetapp Endpoint HomeController.java getLikeMovieList sql injectionEPSS 0.2%CVE-2026-11558MEDIUMCodeAstro Payroll System home_salary.php sql injectionEPSS 0.2%CVE-2024-39037MEDIUMMyNET up to v26.08.316 was discovered to contain an Unauthenticated SQL Injection vulnerability via the intmenu parameter.EPSS 0.2%CVE-2025-26047MEDIUMLoggrove v1.0 is vulnerable to SQL Injection in the read.py file.EPSS 0.2%CVE-2026-24367HIGHWordPress Traveler theme < 3.2.8 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-37428MEDIUMqihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysDeptMapper.xml file. EPSS 0.2%CVE-2026-15183CRITICALInput Validation Vulnerabilities in Snowflake Spark ConnectorEPSS 0.2%CVE-2025-60266MEDIUMIn xckk v9.6, there is a SQL injection vulnerability in which the orderBy parameter in address/list is not securely filtered, resulting in aEPSS 0.2%CVE-2026-57230MEDIUMOpenReplay: Authenticated ClickHouse SQL injection via session searchEPSS 0.2%CVE-2021-25427—SQL injection vulnerability in Bluetooth prior to SMR July-2021 Release 1 allows unauthorized access to paired device informationEPSS 0.2%CVE-2026-7612MEDIUMitsourcecode Courier Management System edit_user.php sql injectionEPSS 0.2%CVE-2026-10155MEDIUMBdtask Multi-Store Inventory Management System Accounts Report Accounts.php accounts_report_search sql injectionEPSS 0.2%CVE-2026-7253MEDIUMIBM Sterling File Gateway SQL InjectionEPSS 0.2%CVE-2026-7282MEDIUMSourceCodester Pharmacy Sales and Inventory System ajax.php delete_expired sql injectionEPSS 0.2%CVE-2026-7697MEDIUMAMTT Hotel Broadband Operation System cardhand_submit.php sql injectionEPSS 0.2%CVE-2026-10171MEDIUMcode-projects Online Music Site AdminUpdateAlbum.php sql injectionEPSS 0.2%CVE-2026-8772MEDIUMlinlinjava litemall Admin Endpoint sql injectionEPSS 0.2%CVE-2026-7553MEDIUMcode-projects Gym Management System edit_exercises.php sql injectionEPSS 0.2%CVE-2026-7293MEDIUMSourceCodester Pizzafy Ecommerce System ajax.php delete_category sql injectionEPSS 0.2%