Fallos del tipo CWE-89

13.394 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-45240MEDIUMfoxcms v1.2.5 was discovered to contain a SQL injection vulnerability via the executeCommand method in DataBackup.php.EPSS 0.3%CVE-2026-32580HIGHWordPress WooCommerce Lottery plugin <= 2.2.9 - SQL Injection vulnerabilityEPSS 0.3%CVE-2019-25500HIGHSimple Job Script SQL Injection via register-recruiters endpointEPSS 0.3%CVE-2025-13579MEDIUMcode-projects Library System return.php sql injectionEPSS 0.3%CVE-2025-13090MEDIUMWP Directory Kit <= 1.4.6 - Authenticated (Admin+) SQL InjectionEPSS 0.3%CVE-2026-6991MEDIUMcolinhacks Zod CUID Data Type regexes.ts sql injectionEPSS 0.3%CVE-2026-0678MEDIUMShipping Rates by City for WooCommerce <= 1.0.3 - Authenticated (Shop Manager+) SQL Injection via 'cities' ParameterEPSS 0.3%CVE-2025-12750MEDIUMGroundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL InjectionEPSS 0.3%CVE-2025-13580MEDIUMcode-projects Library System mail.php sql injectionEPSS 0.3%CVE-2025-54678CRITICALWordPress Easy Form Builder Plugin <= 3.8.15 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-57739HIGHAn improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet ForEPSS 0.3%CVE-2025-54669CRITICALWordPress MapSVG Plugin < 8.7.4 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-63152HIGHOmnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilterEPSS 0.3%CVE-2022-41680HIGHSQL Injection in Forma LMSEPSS 0.3%CVE-2018-25372HIGHMedDream PACS Server Premium 6.7.1.1 SQL Injection via emailEPSS 0.3%CVE-2026-77184MEDIUMMongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE OutputEPSS 0.3%CVE-2019-25505HIGHTradebox 5.4 SQL Injection via symbol ParameterEPSS 0.3%CVE-2026-63165HIGHOmnispace Agora Project < 26.10.0 SQL Injection via sortEvents ParameterEPSS 0.3%CVE-2019-25638HIGHMeeplace Business Review Script Lastest SQL Injection via addclick.phpEPSS 0.3%CVE-2026-93368HIGHRename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) ParameterEPSS 0.3%