Fallos del tipo CWE-89

12.847 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2023-47637HIGHSQL Injection in Admin Grid Filter API in PimcoreEPSS 1.2%CVE-2024-13478HIGHLTL Freight Quotes – TForce Edition <= 3.6.4 - Unauthenticated SQL InjectionEPSS 1.2%CVE-2022-2421CRITICALSocket.io - Improper type validation in attachment parsingEPSS 1.2%CVE-2024-30998CRITICALSQL Injection vulnerability in PHPGurukul Men Salon Management System v.2.0, allows remote attackers to execute arbitrary code and obtain seEPSS 1.2%CVE-2022-35156CRITICALBus Pass Management System 1.0 was discovered to contain a SQL Injection vulnerability via the searchdata parameter at /buspassms/download-pEPSS 1.2%CVE-2026-61667CRITICALDIRAC: RCE in FileCatalog DatasetManager via SQL injection + evalEPSS 1.2%CVE-2019-13409—A SQL injection vulnerability was discovered in TOPMeeting before version 8.8 (2019/08/19)EPSS 1.2%CVE-2023-27568HIGHSQL injection vulnerability inSpryker Commerce OS 0.9 that allows for access to sensitive data via customer/order?orderSearchForm[searchTextEPSS 1.2%CVE-2022-2559—Fluent Support < 1.5.8 - Admin+ SQLiEPSS 1.2%CVE-2022-37208HIGHJFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses itsEPSS 1.2%CVE-2023-22268MEDIUMZDI-CAN-21308: Adobe RoboHelp Server getRHSGroupsForRoles SQL Injection Information Disclosure VulnerabilityEPSS 1.2%CVE-2024-44812CRITICALSQL Injection vulnerability in Online Complaint Site v.1.0 allows a remote attacker to escalate privileges via the username and password parEPSS 1.2%CVE-2021-24141—Advanced Database Cleaner < 3.0.2 - Authenticated SQL injectionEPSS 1.2%CVE-2021-24140—Ajax Load More < 5.3.2 - Authenticated SQL InjectionEPSS 1.2%CVE-2017-20125MEDIUMOnline Hotel Booking System Pro roomtype-details.php sql injectionEPSS 1.2%CVE-2022-41703MEDIUMApache Superset: SQL injection vulnerability in adhoc clausesEPSS 1.2%CVE-2024-55976CRITICALWordPress Critical Site Intel plugin <= 1.0 - SQL Injection vulnerabilityEPSS 1.2%CVE-2026-34885HIGHWordPress Media LIbrary Assistant plugin <= 3.34 - SQL Injection vulnerabilityEPSS 1.2%CVE-2018-5443—A SQL Injection issue was discovered in Advantech WebAccess/SCADA versions prior to V8.2_20170817. WebAccess/SCADA does not properly sanitizEPSS 1.2%CVE-2026-49004MEDIUMPostgreSQL Misconfiguration and Command Injection Vulnerability in ZTE NX799J (Red Magic 11 Air) ProductEPSS 1.2%