Fallos del tipo CWE-89

13.391 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-25418HIGHWordPress Bit Form plugin <= 2.21.10 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-67517HIGHWordPress ArtPlacer Widget plugin <= 2.22.9.2 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-67518HIGHWordPress Accordion Slider PRO plugin <= 1.2 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-56380MEDIUMFrappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_valueEPSS 0.3%CVE-2026-40455HIGHSQL Injection in LMSEPSS 0.3%CVE-2025-54026HIGHWordPress GymBase Theme Classes plugin <= 1.4 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-29529MEDIUMITC Systems Multiplan/Matrix OneCard platform v3.7.4.1002 was discovered to contain a SQL injection vulnerability via the component ForgotpaEPSS 0.3%CVE-2026-97883MEDIUMmathurvishal CloudClassroom-PHP-Project updatequery.php sql injectionEPSS 0.3%CVE-2026-10110MEDIUMcode-projects Student Details Management System index.php sql injectionEPSS 0.3%CVE-2025-52822HIGHWordPress WP Roadmap plugin <= 2.1.3 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-52821HIGHWordPress Video List Manager plugin <= 1.7 - SQL Injection VulnerabilityEPSS 0.3%CVE-2024-43018MEDIUMPiwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register. These parameters are used in ws_user_geEPSS 0.3%CVE-2026-10607MEDIUMDedeCMS flink.php dede_htmlspecialchars sql injectionEPSS 0.3%CVE-2024-9149HIGHSQLi in Wind Media's E-Commerce Website TemplateEPSS 0.3%CVE-2026-38467MEDIUMA SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows reEPSS 0.3%CVE-2025-34245MEDIUMAdvantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxStandaloneVpnClientsController.ajaxAction()EPSS 0.3%CVE-2025-34241MEDIUMAdvantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxDeviceController.ajaxDeviceAction()EPSS 0.3%CVE-2025-34246MEDIUMAdvantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxPrevalidationController.ajaxAction()EPSS 0.3%CVE-2025-15142MEDIUM9786 phpok3w show.php sql injectionEPSS 0.3%CVE-2025-34242HIGHAdvantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxNetworkController.ajaxAction()EPSS 0.3%