Fallos del tipo CWE-89

13.379 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-12860MEDIUMDedeBIZ freelist_main.php sql injectionEPSS 0.3%CVE-2020-37141HIGHAMSS++ v 4.31 - 'id' SQL InjectionEPSS 0.3%CVE-2025-7662MEDIUMGestion de tarifs <= 1.4 - Authenticated (Contributor+) SQL InjectionEPSS 0.3%CVE-2026-34018MEDIUMAn SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the pEPSS 0.3%CVE-2026-39795CRITICALWordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-42417CRITICALWordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-10762MEDIUMkuaifan DooTask UsersController.php sql injectionEPSS 0.3%CVE-2024-46531MEDIUMphpgurukul Vehicle Record Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchinputdata parameter aEPSS 0.3%CVE-2024-54446HIGHBlind SQLi in Document HistoryEPSS 0.3%CVE-2026-107103CRITICALSQL Injection Vulnerability in Manacle Technologies ERP SystemEPSS 0.3%CVE-2025-10968HIGHSQLi in GG Soft's PaperWorkEPSS 0.3%CVE-2024-54447HIGHBlind SQLi in Saved SearchEPSS 0.3%CVE-2026-36946LOWSourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/inquiries/view_EPSS 0.3%CVE-2025-46773HIGHAn Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet ForEPSS 0.3%CVE-2026-81420HIGHTcard WP <= 1.8.0 - Unauthenticated SQLi via group_id ParameterEPSS 0.3%CVE-2025-15239HIGHQuanta Computer｜QOCA aim AI Medical Cloud Platform - SQL InjectionEPSS 0.3%CVE-2025-40682HIGHSQL injection vulnerability in Human Resource Management SystemEPSS 0.3%CVE-2026-36919LOWSourcecodester Online Reviewer System v1.0 is vulnerale to SQL Injection in the file /system/system/admins/assessments/examproper/exam-updatEPSS 0.3%CVE-2024-10546MEDIUMopen-scratch Teaching 在线教学平台 URL getDictItemsByTable sql injectionEPSS 0.3%CVE-2026-23805HIGHWordPress Media Search Enhanced plugin <= 0.9.1 - SQL Injection vulnerabilityEPSS 0.3%