Fallos del tipo CWE-89

13.396 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-110840HIGHn8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query FieldEPSS 0.3%CVE-2024-30872MEDIUMnetentsec NS-ASG 6.3 is vulnerable to SQL Injection via /include/authrp.php.EPSS 0.3%CVE-2026-62031CRITICALWordPress uListing plugin <= 2.2.0 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-59920HIGHSQL injection in time@work from systems@workEPSS 0.3%CVE-2025-61540MEDIUMSQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php.EPSS 0.3%CVE-2026-109698CRITICALWordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-67811MEDIUMArea9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated users. Insufficient input validation allowEPSS 0.3%CVE-2026-95593HIGHWordPress Ultimeter plugin <= 3.0.8 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-79387MEDIUMSQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (iEPSS 0.3%CVE-2026-96822CRITICALWordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-94174HIGHWordPress Email Log plugin <= 2.63 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-46011MEDIUMListmonk v4.1.0 (fixed in v5.0.0) is vulnerable to SQL Injection in the QuerySubscribers function which allows attackers to escalate privileEPSS 0.3%CVE-2026-95522HIGHWordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-42416HIGHWordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-39771HIGHWordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-11482MEDIUMSourceCodester Class and Exam Timetabling System archive5.php sql injectionEPSS 0.3%CVE-2025-10870CRITICALSQL injection in DIAL's CentrosNetEPSS 0.3%CVE-2026-42414HIGHWordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-40636CRITICALSQL injection in the mod_vvisit_counter moduleEPSS 0.3%CVE-2024-48238MEDIUMWTCMS 1.0 is vulnerable to SQL Injection in the edit_post method of /Admin\Controller\NavControl.class.php via the parentid parameter.EPSS 0.3%