Fallos del tipo CWE-89

12.853 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-32231MEDIUMStash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter.EPSS 1.2%CVE-2025-49759HIGHMicrosoft SQL Server Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2017-12729—A SQL Injection issue was discovered in Moxa SoftCMS Live Viewer through 1.6. An improper neutralization of special elements used in an SQL EPSS 1.2%CVE-2021-24465—Meow Gallery < 4.1.9 - Contributor+ SQL InjectionEPSS 1.2%CVE-2025-13652MEDIUMCBX Bookmark & Favorite <= 2.0.4 - Authenticated (Subscriber+) SQL Injection via `orderby` ParameterEPSS 1.2%CVE-2023-26922CRITICALSQL injection vulnerability found in Varisicte matrix-gui v.2 allows a remote attacker to execute arbitrary code via the shell_exect parametEPSS 1.2%CVE-2022-44015CRITICALAn issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can inject raw SQL queries. By activating MSSQL features, the EPSS 1.2%CVE-2021-43851HIGHSQL injection vulnerability in anuko timetrackerEPSS 1.2%CVE-2022-40484CRITICALWedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client_edit.php.EPSS 1.2%CVE-2021-24360—Yes/No Chart < 1.0.12 - Authenticated (contributor+) Blind SQL InjectionEPSS 1.2%CVE-2023-30465MEDIUMApache InLong: SQL injection in apache inLong 1.5.0EPSS 1.2%CVE-2019-7001CRITICALAvaya IPOCC WebUI SQL InjectionEPSS 1.2%CVE-2024-28558HIGHSQL Injection vulnerability in sourcecodester Petrol pump management software v1.0, allows remote attackers to execute arbitrary code, escalEPSS 1.2%CVE-2023-26865CRITICALSQL injection vulnerability found in PrestaShop bdroppy v.2.2.12 and before allowing a remote attacker to gain privileges via the BdroppyCroEPSS 1.2%CVE-2024-24140HIGHSourcecodester Daily Habit Tracker App 1.0 allows SQL Injection via the parameter 'tracker.'EPSS 1.2%CVE-2017-20067HIGHHindu Matrimonial Script sql injectionEPSS 1.2%CVE-2021-22851CRITICALHGiga OAKloud Portal - SQL injection -1EPSS 1.2%CVE-2025-53727HIGHMicrosoft SQL Server Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2023-3820HIGHSQL Injection in pimcore/pimcoreEPSS 1.2%CVE-2024-24139HIGHSourcecodester Login System with Email Verification 1.0 allows SQL Injection via the 'user' parameter.EPSS 1.2%