Fallos del tipo CWE-89

13.401 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-96828HIGHWordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-96346HIGHWordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-100752CRITICALJoomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9EPSS 0.3%CVE-2026-42717HIGHWordPress Leyka plugin <= 3.32.3 - SQL Injection vulnerabilityEPSS 0.3%CVE-2024-25528MEDIUMRuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_template_sEPSS 0.3%CVE-2026-101108CRITICALJoomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8EPSS 0.3%CVE-2025-39510HIGHWordPress Pinterest Automatic Pin plugin < 4.19.0 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-32993MEDIUMVision Helpdesk through 5.7.0 allows Time-Based Blind SQL injection via the Forgot Password (aka index.php?/home/forgot-password) vis_usernaEPSS 0.3%CVE-2026-42722HIGHWordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-104408HIGHWordPress Groundhogg plugin <= 4.8.3 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-88424CRITICALFineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). ThiEPSS 0.3%CVE-2026-94082HIGHWordPress Quiz Cat plugin <= 3.1.1 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-96345HIGHWordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-52924MEDIUMIn One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrusted X-RequestId HTTP rEPSS 0.3%CVE-2025-11740MEDIUMwpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL InjectionEPSS 0.3%CVE-2026-105317HIGHWordPress Paid Member Subscriptions plugin <= 3.1.1 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-105067HIGHWordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-15450MEDIUMsfturing hosp_order orderHos findOrderHosNum sql injectionEPSS 0.3%CVE-2026-109901HIGHWordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-62117HIGHWordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerabilityEPSS 0.3%