Fallos del tipo CWE-89

13.402 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2019-25642HIGHBootstrapy CMS Lastest Multiple SQL Injection via Forum and Contact ModulesEPSS 0.3%CVE-2026-10620MEDIUMcode-projects Student Admission System index.php sql injectionEPSS 0.3%CVE-2025-15441MEDIUMForm Maker < 1.15.38 - SQL InjectionEPSS 0.3%CVE-2026-2435MEDIUMASSET-7706EPSS 0.3%CVE-2026-61294MEDIUMVulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Calendar Synchronizations). SupportEPSS 0.3%CVE-2024-55212MEDIUMDNNGo xBlog v6.5.0 was discovered to contain a SQL injection vulnerability via the Categorys parameter at /DNNGo_xBlog/Resource_Service.aspxEPSS 0.3%CVE-2026-62527MEDIUMVulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Import And Export). Supported versions that EPSS 0.3%CVE-2026-62528MEDIUMVulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Install). Supported versions that arEPSS 0.3%CVE-2026-61266MEDIUMVulnerability in the Oracle Supply Chain Globalization product of Oracle E-Business Suite (component: Copy Inventory Organization). SupportEPSS 0.3%CVE-2025-63029HIGHWordPress WCFM Marketplace plugin <= 3.7.1 - SQL Injection vulnerabilityEPSS 0.3%CVE-2019-25440HIGHWebIncorp ERP Every version SQL Injection via product_detail.phpEPSS 0.3%CVE-2019-25726HIGHAll in One Video Downloader 1.2 SQL Injection via admin page-editEPSS 0.3%CVE-2018-25415HIGHAiOPMSD Final 1.0.0 SQL Injection via director ParameterEPSS 0.3%CVE-2018-25420HIGHAiOPMSD Final 1.0.0 SQL Injection via watch.phpEPSS 0.3%CVE-2023-4674—SQLi in Yazteks E-Commerce SoftwareEPSS 0.3%CVE-2016-20073HIGHAnswer My Question 1.3 Plugin WordPress SQL Injection via modal.phpEPSS 0.3%CVE-2020-37218HIGHJoomla com_hdwplayer 4.2 SQL Injection via search.phpEPSS 0.3%CVE-2018-25405HIGHeNdonesia Portal 8.7 SQL Injection via mod.phpEPSS 0.3%CVE-2025-67829CRITICALMura before 10.1.14 allows beanFeed.cfc getQuery sortDirection SQL injection.EPSS 0.3%CVE-2019-25446HIGHDIGIT CENTRIS ERP Every version SQL Injection via datum1 ParameterEPSS 0.3%