Fallos del tipo CWE-89

13.374 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-13276MEDIUMg33kyrash Online-Banking-System index.php sql injectionEPSS 0.3%CVE-2026-105776MEDIUMbhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL admin_transaction.php sql injectionEPSS 0.3%CVE-2025-10037MEDIUMFeatured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL InjectionEPSS 0.3%CVE-2025-3571MEDIUMFannuo Enterprise Content Management System 凡诺企业网站管理系统 cms_chip.php sql injectionEPSS 0.3%CVE-2025-3382MEDIUMjoey-zhou xiaozhi-esp32-server-java update sql injectionEPSS 0.3%CVE-2025-65091CRITICALXWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONServiceEPSS 0.3%CVE-2025-13395MEDIUMcodehub666 94list function.php login sql injectionEPSS 0.3%CVE-2026-105387MEDIUMgirishsaraf Online-Appointment-Booking-System Patient Login cover.php mysqli_query sql injectionEPSS 0.3%CVE-2026-105386MEDIUMonetwothreeneth HospitalManagementSystem print.php get sql injectionEPSS 0.3%CVE-2025-3003MEDIUMESAFENET CDG UserAjax sql injectionEPSS 0.3%CVE-2019-25684HIGHOpenDocMan 1.3.4 SQL Injection via where ParameterEPSS 0.3%CVE-2026-13752MEDIUMSnowflake CLI SQL Injection Through Improper Neutralization of Parameters in Secret Creation and SPCS Service Log CommandsEPSS 0.3%CVE-2026-111718HIGHAipexBase through commit 690adb9 SQL Injection via /api/data/invokeEPSS 0.3%CVE-2025-9690MEDIUMSourceCodester Advanced School Management System vendordetails sql injectionEPSS 0.3%CVE-2025-27261HIGHEricsson Indoor Connect 8855 - Improper Neutralization of Special Elements used in an SQL Command VulnerabilityEPSS 0.3%CVE-2025-52040HIGHIn Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows EPSS 0.3%CVE-2024-41767HIGHIBM Engineering Lifecycle Optimization - Publishing SQL injectionEPSS 0.3%CVE-2025-52042HIGHIn Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/request_for_quotation.EPSS 0.3%CVE-2025-22212LOWExtension - tassos.gr - SQL injection in Convert Forms component version 1.0.0-1.0.0 - 4.4.9 for JoomlaEPSS 0.3%CVE-2025-41233MEDIUMDescription: VMware AVI Load Balancer contains an authenticated blind SQL Injection vulnerability. VMware has evaluated the severity of theEPSS 0.3%