Fallos del tipo CWE-89

13.396 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-25234MEDIUMPEAR is Vulnerable to SQL Injection in Category DeletionEPSS 0.3%CVE-2026-33505HIGHOry Keto has a SQL injection via forged pagination tokensEPSS 0.3%CVE-2025-14153MEDIUMPage Expire Popup/Redirection for WordPress <= 1.0 - Authenticated (Author+) SQL Injection via 'id' Shortcode AttributeEPSS 0.3%CVE-2026-37428MEDIUMqihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysDeptMapper.xml file. EPSS 0.3%CVE-2026-6476HIGHPostgreSQL pg_createsubscriber allows SQL injection via subscription nameEPSS 0.3%CVE-2025-5433MEDIUMFengoffice Feng Office index.php sql injectionEPSS 0.3%CVE-2026-37429MEDIUMqihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysUserMapper.xml file. EPSS 0.3%CVE-2024-33803MEDIUMA SQL injection vulnerability in /model/get_exam.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execEPSS 0.3%CVE-2026-95590HIGHWordPress Tainacan plugin <= 1.2.0 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-37337HIGHSourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_playlist.php.EPSS 0.3%CVE-2025-29267MEDIUMSQL Injection vulnerability in Abis, Inc Adjutant Core Accounting ERP build v.PreBeta250F allows a remote attacker to obtain a sensitive infEPSS 0.3%CVE-2026-73345HIGHWordPress License Manager for WooCommerce plugin <= 3.0.18 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-104142HIGHDataEase: Stored SQL Injection in group-field binning boundsEPSS 0.3%CVE-2025-62319CRITICALBoolean-Based SQL Injection in Multiple Unica ComponentsEPSS 0.3%CVE-2025-45809MEDIUMSQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/kEPSS 0.3%CVE-2024-33807MEDIUMA SQL injection vulnerability in /model/get_teacher_timetable.php in campcodes Complete Web-Based School Management System 1.0 allows an attEPSS 0.3%CVE-2025-56216HIGHphpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in about-us.php via the pagetitle parameter.EPSS 0.3%CVE-2026-37336HIGHSourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_music.php.EPSS 0.3%CVE-2026-65494HIGHWordPress Dokan Pro plugin <= 5.0.2 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-36948HIGHSourcecodester Online Thesis Archiving System v1.0 is vulnerale to SQL injection in the file /otas/view_archive.php.EPSS 0.3%