Fallos del tipo CWE-89

12.042 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-55849HIGHWeiPHP v5.0 and before is vulnerable to SQL Injection via the SucaiController.class.php file and the cancelTemplateeEPSS 0.2%CVE-2025-67261MEDIUMAbacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection. The vulnerability exists in the Search function oEPSS 0.2%CVE-2023-33770MEDIUMReal Estate Management System v1.0 was discovered to contain a SQL injection vulnerability via the message parameter at /contact.php.EPSS 0.2%CVE-2025-42889MEDIUMSQL Injection vulnerability in SAP Starter Solution (PL SAFT)EPSS 0.2%CVE-2026-6638LOWPostgreSQL REFRESH PUBLICATION allows SQL injection via table nameEPSS 0.2%CVE-2026-34018MEDIUMAn SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the pEPSS 0.2%CVE-2026-3781MEDIUMAttendance Manager <= 0.6.2 - Authenticated (Subscriber+) SQL Injection via 'attmgr_off' ParameterEPSS 0.2%CVE-2025-25582MEDIUMyimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the selectNoticeList() method at /xml/OaNoticeMapper.xEPSS 0.2%CVE-2026-15381LOWWP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filterEPSS 0.2%CVE-2026-47255HIGHAgenticMail API/storage and outbound relay hardeningEPSS 0.2%CVE-2026-13596CRITICALParticipants Database < 2.7.8.4 - Unauthenticated SQL Injection via List SearchEPSS 0.2%CVE-2025-67285HIGHA SQL injection vulnerability was found in the '/cts/admin/?page=zone' file of ITSourcecode COVID Tracking System Using QR-Code v1.0. The reEPSS 0.2%CVE-2024-55159MEDIUMGFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the SortName parameter at /system/loginLog/list.EPSS 0.2%CVE-2026-16532CRITICALLink Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission FormEPSS 0.2%CVE-2025-69949HIGHkishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php via the parameters emailid and email.EPSS 0.2%CVE-2025-64104HIGHLangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStoreEPSS 0.2%CVE-2026-15829HIGHSQL Injection and Security Boundary Bypass in googleapis/mcp-toolboxEPSS 0.2%CVE-2026-15929HIGHImproper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in LG Electronics SmartShare allows SQL IEPSS 0.2%CVE-2023-7333MEDIUMbluelabsio records-mover Table Object sql injectionEPSS 0.2%CVE-2023-40254HIGHDownload of Code Without Integrity Check vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, GEPSS 0.2%