Fallos del tipo CWE-89

13.380 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2018-25330HIGHJoomla! EkRishta 2.10 Persistent XSS and SQL InjectionEPSS 0.3%CVE-2026-80381CRITICALMultiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data ProtectionEPSS 0.3%CVE-2025-28076MEDIUMMultiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.4 and CO2Scope <= 1.3.4 allows remote authenticated attackers to execute aEPSS 0.3%CVE-2025-13495MEDIUMFluentCart A New Era of eCommerce <= 1.3.1 - Authenticated (Administrator+) SQL Injection via 'groupKey' ParameterEPSS 0.3%CVE-2019-25699HIGHNewsbull Haber Script 1.0.0 Authenticated SQL Injection via search parameterEPSS 0.3%CVE-2020-37006HIGHberliCRM 1.0.24 - 'src_record' SQL InjectionEPSS 0.3%CVE-2020-37147HIGHATutor 2.2.4 - 'id' SQL InjectionEPSS 0.3%CVE-2026-40018HIGHNone None None No publicly available exploits are known.EPSS 0.3%CVE-2025-10593MEDIUMSourceCodester Online Student File Management System update_student.php sql injectionEPSS 0.3%CVE-2025-13409MEDIUMForm Vibes – Database Manager for Forms <= 1.4.13 - Authenticated (Admin+) SQL InjectionEPSS 0.3%CVE-2025-14050MEDIUMDesign Import/Export <= 2.2 - Authenticated (Administrator+) SQL Injection via XML File ImportEPSS 0.3%CVE-2025-52410CRITICALInstitute-of-Current-Students v1.0 contains a time-based blind SQL injection vulnerability in the mydetailsstudent.php endpoint. The `myds` EPSS 0.3%CVE-2024-34928HIGHA SQL injection vulnerability in /model/update_subject_routing.php in Campcodes Complete Web-Based School Management System 1.0 allows an atEPSS 0.3%CVE-2026-5578MEDIUMCodeAstro Online Classroom Parameter addassessment.php sql injectionEPSS 0.3%CVE-2026-7148MEDIUMCodeAstro Online Classroom addnewfaculty sql injectionEPSS 0.3%CVE-2026-84153MEDIUMXinhu Rainrock RockOA index.php toaddval sql injectionEPSS 0.3%CVE-2026-7746MEDIUMSourceCodester Web-based Pharmacy Product Management System edit-admin.php sql injectionEPSS 0.3%CVE-2026-7745MEDIUMCodeAstro Online Classroom facultydetails sql injectionEPSS 0.3%CVE-2025-48891HIGHAdvantech iView SQL InjectionEPSS 0.3%CVE-2026-5543MEDIUMPHPGurukul User Registration & Login and User Management System yesterday-reg-users.php sql injectionEPSS 0.3%