Fallos del tipo CWE-89

13.379 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-64156MEDIUMAn improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7EPSS 0.3%CVE-2025-4510MEDIUMChangjietong UFIDA CRM optntyday.php sql injectionEPSS 0.3%CVE-2024-35090HIGHJ2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysUreportFileMapper.xml.EPSS 0.3%CVE-2025-49467CRITICALJoomla Extension - jevents.net - SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for JoomlaEPSS 0.3%CVE-2025-55787CRITICALIn MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists.EPSS 0.3%CVE-2026-102428CRITICALJoomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16EPSS 0.3%CVE-2026-12718CRITICALSQLi in Karel Electronics' KarelIPSEPSS 0.3%CVE-2025-67082MEDIUMAn SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generatiEPSS 0.3%CVE-2024-57238HIGHProlink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to SQL Injection in in the /reqproc/proc_get endpoint. The vulnerability allowsEPSS 0.3%CVE-2024-3370HIGHSQLi in Egebilgi Software's Website TemplateEPSS 0.3%CVE-2019-25536HIGHNetartmedia PHP Real Estate Agency 4.0 SQL Injection via features parameterEPSS 0.3%CVE-2025-47651HIGHWordPress Infility Global plugin <= 2.15.06 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-40762HIGHWordPress WPGraphQL plugin < 2.11.1 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-113608MEDIUMConfigurable Reports block for Moodle before 5.3.1 SQL Injection via filter_varEPSS 0.3%CVE-2018-25424HIGHGate Pass Management System 2.1 SQL Injection via login-exec.phpEPSS 0.3%CVE-2026-66622HIGHWordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerabilityEPSS 0.3%CVE-2024-34327MEDIUMSielox AnyWare v2.1.2 was discovered to contain a SQL injection vulnerability via the email address field of the password reset form.EPSS 0.3%CVE-2025-13586MEDIUMSourceCodester Online Student Clearance System changepassword.php sql injectionEPSS 0.3%CVE-2026-54829HIGHWordPress WP Photo Album Plus plugin <= 9.1.13.005 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-108474CRITICALIn JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functionsEPSS 0.3%