Fallos del tipo CWE-89

12.846 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2022-1472—Better Find and Replace < 1.3.6 - Admin+ SQLiEPSS 1.3%CVE-2021-24143—AccessPress Social Icons < 1.8.1 - Authenticated SQL InjectionEPSS 1.3%CVE-2025-22461HIGHSQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admiEPSS 1.3%CVE-2021-24185—Tutor LMS < 1.7.7 - SQL Injection via tutor_place_ratingEPSS 1.3%CVE-2021-24186—Tutor LMS < 1.8.3 - SQL Injection via tutor_answering_quiz_question/get_answer_by_idEPSS 1.3%CVE-2021-24181—Tutor LMS < 1.7.7 - SQL Injection via tutor_mark_answer_as_correctEPSS 1.3%CVE-2020-3936CRITICALUnisoon UltraLog Express - SQL InjectionEPSS 1.2%CVE-2025-50455CRITICALSQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1.EPSS 1.2%CVE-2023-36189HIGHSQL injection vulnerability in langchain before v0.0.247 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain cEPSS 1.2%CVE-2021-1222MEDIUMCisco Smart Software Manager Satellite SQL Injection VulnerabilityEPSS 1.2%CVE-2021-37497CRITICALSQL injection vulnerability in route of PbootCMS 3.0.5 allows remote attackers to run arbitrary SQL commands via crafted GET request.EPSS 1.2%CVE-2023-48118CRITICALSQL Injection vulnerability in Quest Analytics LLC IQCRM v.2023.9.5 allows a remote attacker to execute arbitrary code via a crafted requestEPSS 1.2%CVE-2022-39041CRITICALaEnrich a+HRD - SQL InjectionEPSS 1.2%CVE-2024-54820CRITICALXOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page. This vulnerabiEPSS 1.2%CVE-2020-29168CRITICALSQL Injection vulnerability in Projectworlds Online Doctor Appointment Booking System, allows attackers to gain sensitive information via thEPSS 1.2%CVE-2017-11161—Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary EPSS 1.2%CVE-2022-24628HIGHAn issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is authenticated SQL injection in the id parameter EPSS 1.2%CVE-2023-47460HIGHSQL injection vulnerability in Knovos Discovery v.22.67.0 allows a remote attacker to execute arbitrary code via the /DiscoveryProcess/ServiEPSS 1.2%CVE-2021-24142—301 Redirects - Easy Redirect Manager < 2.51 - Authenticated SQL InjectionEPSS 1.2%CVE-2022-42064CRITICALOnline Diagnostic Lab Management System version 1.0 remote exploit that bypasses login with SQL injection and then uploads a shell.EPSS 1.2%