Fallos del tipo CWE-89

13.394 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-68999HIGHWordPress Happy Addons for Elementor plugin <= 3.20.4 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-68881HIGHWordPress AppExperts plugin <= 1.4.5 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-67516HIGHWordPress Store Locator WordPress plugin <= 1.6.2 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-67950HIGHWordPress All In One SEO Pack plugin <= 4.9.1 - SQL Injection vulnerabilityEPSS 0.3%CVE-2024-49588MEDIUMMultiple authenticated SQL injections in oracle-sidecarEPSS 0.3%CVE-2025-69180HIGHWordPress Ultra Portfolio plugin <= 6.7 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-67921HIGHWordPress Lobo theme < 2.8.6 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-62655LOWSQL injection in Cargo via Special:CargoExportEPSS 0.3%CVE-2025-65877HIGHLvzhou CMS before commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 (2025-09-22) is vulnerable to SQL injection via the 'title' parameter in cEPSS 0.3%CVE-2026-102578MEDIUMMoodle: sql injection in question bank web serviceEPSS 0.3%CVE-2026-62262CRITICALPiwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create`EPSS 0.3%CVE-2025-5782MEDIUMPHPGurukul Employee Record Management System resetpassword.php sql injectionEPSS 0.3%CVE-2026-20003MEDIUMA vulnerability in the REST API of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks EPSS 0.3%CVE-2026-1198HIGHSQL Injection in SIMPLE.ERPEPSS 0.3%CVE-2025-26241MEDIUMA SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket <=1.17.5 allows authenticated attackers to exeEPSS 0.3%CVE-2026-4889HIGHSQL Injection (SQLi) in eLoanApp Platform by RDL TechnologiesEPSS 0.3%CVE-2025-10748MEDIUMRapidResult <= 1.2 - Authenticated (Contributor+) SQL InjectionEPSS 0.3%CVE-2025-12812MEDIUMCloud Suite and Privilege Access Service – SQL InjectionEPSS 0.3%CVE-2025-41004HIGHMultiple vulnerabilities in Imaster products Open configuration optionsEPSS 0.3%CVE-2025-8994MEDIUMWP Project Manager <= 2.6.26 - Authenticated (Subscriber+) SQL Injection via 'completed_at_operator'EPSS 0.3%