Fallos del tipo CWE-89

13.368 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-11981MEDIUMSchool Management System – WPSchoolPress <= 2.2.23 - Authenticated (Administrator+) SQL InjectionEPSS 0.3%CVE-2026-96267HIGHWP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' ParameterEPSS 0.3%CVE-2023-42235LOWAn issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiEPSS 0.3%CVE-2025-11972MEDIUMTag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.0 - Authenticated (Editor+) SQL InjectionEPSS 0.3%CVE-2026-92766HIGHVitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' ParameterEPSS 0.3%CVE-2025-11980MEDIUMQuick Featured Images <= 13.7.3 - Authenticated (Editor+) SQL Injection via delete_orphanedEPSS 0.3%CVE-2026-17543HIGHSQL injection in ext-pgsql via E'...' backslash breakoutEPSS 0.3%CVE-2026-18561HIGHUnlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL InjectionEPSS 0.3%CVE-2026-2412MEDIUMQuiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' ParameterEPSS 0.3%CVE-2023-42238LOWAn issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiEPSS 0.3%CVE-2023-42236LOWAn issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GETEPSS 0.3%CVE-2026-57588LOWSQL Injection in Nessus via Malicious Scan Result File ImportEPSS 0.3%CVE-2025-52618MEDIUMHCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerabilityEPSS 0.3%CVE-2026-4593MEDIUMerupts erupt MCP Tool EruptDataQuery.java EruptDataQuery sql injectionEPSS 0.3%CVE-2026-4234MEDIUMSSCMS DDL SitesAddController.Submit.cs sql injectionEPSS 0.3%CVE-2026-4573MEDIUMSourceCodester Simple E-learning System HTTP GET Parameter delete_post.php sql injectionEPSS 0.3%CVE-2025-69310CRITICALWordPress Woodly Core plugin <= 1.4 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-3672MEDIUMJeecgBoot getDictItems isExistSqlInjectKeyword sql injectionEPSS 0.3%CVE-2025-69365CRITICALWordPress Uroan Core plugin <= 1.4.4 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-4230MEDIUMvanna-ai vanna Endpoint __init__.py update_sql sql injectionEPSS 0.3%