Fallos del tipo CWE-89

13.379 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-36923LOWSourcecodester Cab Management System 1.0 is vulnerable to SQL Injection in the file /cms/admin/bookings/view_booking.php.EPSS 0.3%CVE-2025-14770HIGHShipping Rate By Cities <= 2.0.0 - Unauthenticated SQL Injection via 'city' ParameterEPSS 0.3%CVE-2024-10546MEDIUMopen-scratch Teaching 在线教学平台 URL getDictItemsByTable sql injectionEPSS 0.3%CVE-2025-14254HIGHGalaxy Software Services｜Vitals ESP - SQL InjectionEPSS 0.3%CVE-2026-32167MEDIUMSQL Server Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-0404MEDIUMliujianview gymxmjpa CoachController.java CoachController sql injectionEPSS 0.3%CVE-2026-57955HIGHSigNoz 0.130.1 - SQL Injection in Alert History Endpoints via Rule ID ParameterEPSS 0.3%CVE-2025-52831CRITICALWordPress Video List Manager plugin <= 1.7 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-0597MEDIUMCampcodes Supplier Management System edit_profile.php sql injectionEPSS 0.3%CVE-2025-49452CRITICALWordPress PostaPanduri plugin <= 2.1.3 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-71276HIGHMagistrala (formerly Mainflux) IoT Platform SQL Injection via format Query ParameterEPSS 0.3%CVE-2025-52834CRITICALWordPress Homey theme <= 2.4.7 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-52832CRITICALWordPress NGG Smart Image Search plugin <= 3.4.1 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-38528HIGHKrayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rotten_lead parameter at /Lead/LeadDataGrid.php.EPSS 0.3%CVE-2025-6739MEDIUMWPQuiz <= 0.4.2 - Authenticated (Contributor+) SQL InjectionEPSS 0.3%CVE-2026-0582MEDIUMitsourcecode Society Management System edit_activity_query.php sql injectionEPSS 0.3%CVE-2026-20247HIGHCisco Identity Services Engine Unauthenticated SQL Injection VulnerabilityEPSS 0.3%CVE-2025-5017MEDIUMCatalyst Connect Zoho CRM Client Portal <= 2.2.0 - Authenticated (Administrator+) SQL Injection via uid ParameterEPSS 0.3%CVE-2025-14247MEDIUMcode-projects Simple Shopping Cart additems.php sql injectionEPSS 0.3%CVE-2018-25300HIGHXATABoost CMS 1.0.0 SQL Injection via news.phpEPSS 0.3%