Fallos del tipo CWE-89

12.043 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-3346MEDIUMStored Cross-Site Scripting (XSS) in Langflow Markdown Rendering via rehypeRawEPSS 0.2%CVE-2026-16539HIGHSM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page DuplicationEPSS 0.2%CVE-2025-69948CRITICALSourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1.EPSS 0.2%CVE-2026-41125MEDIUMA vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions), blueplanet 105 TL3 (AllEPSS 0.2%CVE-2026-48613HIGHSQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, EPSS 0.2%CVE-2025-6230MEDIUMA SQL injection vulnerability was reported in Lenovo Vantage that could allow a local attacker to modify the local SQLite database and execuEPSS 0.2%CVE-2022-42535MEDIUMIn a query in MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead to local informatioEPSS 0.2%CVE-2026-40522HIGHFrontAccounting < 2.4.20 SQL Injection via rep601.phpEPSS 0.1%CVE-2026-28576CRITICALIn Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disEPSS 0.1%CVE-2025-52646LOWHCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries.EPSS 0.1%CVE-2025-69931CRITICALCodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1.EPSS 0.1%CVE-2025-69944HIGHkishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory.php endpoint via the viewid parameter.EPSS 0.1%CVE-2026-4530MEDIUMapconw Aix-DB terminology_retriever.py sql injectionEPSS 0.1%CVE-2024-14025LOWVideo StationEPSS 0.1%CVE-2026-11475MEDIUMKushan2k student-management-system Certificate Verification Endpoint GradeController.php getStatus sql injectionEPSS 0.1%CVE-2026-39809MEDIUMA improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.0 througEPSS 0.1%CVE-2026-13746LOWSnowflake CLI SQL Injection Through Improper Neutralization of Local CLI ParametersEPSS 0.1%CVE-2025-55703LOWAn error-based SQL injection vulnerability exists in the Sunbird Power IQ 9.2.0 API. The vulnerability is due to an outdated API endpoint thEPSS 0.1%CVE-2025-48650HIGHIn multiple locations, there is a possible information disclosure due to SQL injection. This could lead to local escalation of privilege witEPSS 0.1%CVE-2025-49211HIGHA SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affectedEPSS 0.1%