Fallos del tipo CWE-89

13.394 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-18137HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.3%CVE-2025-9947MEDIUMCustom 404 Pro <= 3.12.0 - Authenticated (Administrator+) SQL Injection via `path` ParameterEPSS 0.3%CVE-2015-10146MEDIUMThumbnail Slider With Lightbox <= 1.0.4 - Authenticated (Admin+) SQL InjectionEPSS 0.3%CVE-2026-109634MEDIUMFrappe ERPNext before 15.121.0 SQL Injection via Unvalidated EndpointsEPSS 0.3%CVE-2026-80298HIGHSQL Injection in HAVELSAN's Sef - AI Chatbot PlatformEPSS 0.3%CVE-2019-25529HIGHPlaceto CMS Alpha rv.4 SQL Injection via page ParameterEPSS 0.3%CVE-2025-30947HIGHWordPress Cool fade popup plugin <= 10.1 - SQL Injection VulnerabilityEPSS 0.3%CVE-2017-20249HIGHWordPress Plugin Apptha Slider Gallery 1.0 SQL InjectionEPSS 0.3%CVE-2023-54333HIGHSocial-Share-Buttons 2.2.3 - SQL Injection via project_id ParameterEPSS 0.3%CVE-2025-30969HIGHWordPress iFrame Images Gallery plugin <= 9.0 - SQL Injection VulnerabilityEPSS 0.3%CVE-2024-22856MEDIUMA SQL injection vulnerability via the Save Favorite Search function in Axefinance Axe Credit Portal >= v.3.0 allows authenticated attackers EPSS 0.3%CVE-2025-12483MEDIUMVisualizer: Tables and Charts Manager for WordPress <= 3.11.12 - Authenticated (Contributor+) SQL InjectionEPSS 0.3%CVE-2026-18630HIGHSQL Injection in TMT Machine's Talassoft Industrial Management SoftwareEPSS 0.3%CVE-2025-28011MEDIUMA SQL Injection was found in loginsystem/change-password.php in PHPGurukul User Registration & Login and User Management System v3.3 allows EPSS 0.3%CVE-2025-30979HIGHWordPress Pixelating image slideshow gallery plugin <= 8.0 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-24780HIGHWordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.4.0 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-13922MEDIUMTag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL Injection via ORDER BY ClauseEPSS 0.3%CVE-2025-32297HIGHWordPress Simple Link Directory Pro plugin < 14.8.1 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-60514MEDIUMTillywork v0.1.3 and below is vulnerable to SQL Injection in app/common/helpers/query.builder.helper.ts.EPSS 0.3%CVE-2025-28969HIGHWordPress Gallery Widget plugin <= 1.2.1 - SQL Injection VulnerabilityEPSS 0.3%