Fallos del tipo CWE-89

13.394 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-23603LOWBIG-IP Advanced WAF and ASM Configuration utility vulnerability EPSS 0.3%CVE-2025-14207MEDIUMtushar-2223 Hotel-Management-System invoiceprint.php sql injectionEPSS 0.3%CVE-2025-7156MEDIUMhitsz-ids airda completions execute sql injectionEPSS 0.3%CVE-2026-18737HIGHShlink Blind SQL Injection via tags/stats orderBy ParameterEPSS 0.3%CVE-2025-8536CRITICALSQL Injection in DobryCMSEPSS 0.3%CVE-2026-103248HIGHn8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via SupabaseEPSS 0.3%CVE-2026-30273HIGHpandas-ai v3.0.0 was discovered to contain a SQL injection vulnerability via the pandasai.agent.base._execute_sql_query component.EPSS 0.3%CVE-2026-24913HIGHSQL Injection vulnerability exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, information stored in the databaEPSS 0.3%CVE-2021-47711HIGHKentico Xperience <= 13.0.52 Online Marketing Macros SQL InjectionEPSS 0.3%CVE-2025-6768MEDIUMsfturing hosp_order HospitalServiceImpl.java findAllHosByCondition sql injectionEPSS 0.3%CVE-2025-51671MEDIUMA SQL injection vulnerability was discovered in the PHPGurukul Dairy Farm Shop Management System 1.3. The vulnerability allows remote attackEPSS 0.3%CVE-2025-39496CRITICALWordPress WooBeWoo Product Filter Pro plugin < 2.9.6 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-49059CRITICALWordPress CleverReach® WP Plugin <= 1.5.20 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-107752MEDIUMWelcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' CookieEPSS 0.3%CVE-2025-54707CRITICALWordPress MDTF Plugin <= 1.3.3.7 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-11020HIGHRemote Code Execution in MarkAny SafePC EnterpriseEPSS 0.3%CVE-2025-67921HIGHWordPress Lobo theme < 2.8.6 - SQL Injection vulnerabilityEPSS 0.3%CVE-2024-49588MEDIUMMultiple authenticated SQL injections in oracle-sidecarEPSS 0.3%CVE-2025-62655LOWSQL injection in Cargo via Special:CargoExportEPSS 0.3%CVE-2025-67950HIGHWordPress All In One SEO Pack plugin <= 4.9.1 - SQL Injection vulnerabilityEPSS 0.3%