Fallos del tipo CWE-89

13.394 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2018-25172HIGHPedidos 1.0 SQL Injection via load_proveedores.phpEPSS 0.3%CVE-2019-25521HIGHXooGallery Lastest Latest SQL Injection via gal.php gal_idEPSS 0.3%CVE-2025-30022MEDIUMCM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the DATANASC parameter.EPSS 0.3%CVE-2026-114065HIGHTrigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table PlaceholdersEPSS 0.3%CVE-2025-41004HIGHMultiple vulnerabilities in Imaster products Open configuration optionsEPSS 0.3%CVE-2025-41005HIGHMultiple vulnerabilities in Imaster products Open configuration optionsEPSS 0.3%CVE-2025-22209MEDIUMExtension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for JoomlaEPSS 0.3%CVE-2026-110911CRITICALWheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOEPSS 0.3%CVE-2025-13385MEDIUMBookme <= 4.2 - Authenticated (Admin+) SQL Injection via 'filter[status]' ParameterEPSS 0.3%CVE-2024-34933MEDIUMA SQL injection vulnerability in /model/update_grade.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to EPSS 0.3%CVE-2026-104456HIGHYesWiki before 4.6.7 Second-Order SQL Injection via ACL UsernameEPSS 0.3%CVE-2024-33804MEDIUMA SQL injection vulnerability in /model/get_subject.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to eEPSS 0.3%CVE-2026-79811HIGHAuthenticated SQL Injection allows Remote Code Execution in ClearPass Policy Manager APIEPSS 0.3%CVE-2026-17418HIGHIBM i is Affected By Multiple Vulnerabilities in SQLEPSS 0.3%CVE-2026-79794CRITICALAuthenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management InterfaceEPSS 0.3%CVE-2026-76309MEDIUMStructured Query Language (SQL) Injection through the REST API in Splunk EnterpriseEPSS 0.3%CVE-2025-10002MEDIUMClickWhale <= 2.5.0 - Authenticated (Admin+) SQL injectionEPSS 0.3%CVE-2015-10146MEDIUMThumbnail Slider With Lightbox <= 1.0.4 - Authenticated (Admin+) SQL InjectionEPSS 0.3%CVE-2015-10147MEDIUMEasy Testimonial Slider and Form <= 1.0.2 - Authenticated (Admin+) SQL injectionEPSS 0.3%CVE-2025-10048MEDIUMMy Auctions Allegro Plugin <= 3.6.31 - Authenticated (Admin+) SQL InjectionEPSS 0.3%