Fallos del tipo CWE-89

13.404 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-11663MEDIUMCampcodes Online Beauty Parlor Management System manage-services.php sql injectionEPSS 0.3%CVE-2025-67102HIGHA SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an authenticated attacker to execute arbitrary SQL coEPSS 0.3%CVE-2025-55476MEDIUMFireShare FileShare 1.2.25 contains a time-based blind SQL injection vulnerability in the sort parameter of the endpoint: GET /api/videos/puEPSS 0.3%CVE-2025-63512MEDIUMkishan0725 Hospital Management System/ v4 is vulnerable to SQL Injection in admin-panel1.php, specifically in the deleting doctor logic. TheEPSS 0.3%CVE-2026-108684MEDIUMerzhongxmu Jeewms Autocomplete Data JeecgFormDemoController.java getTreeData sql injectionEPSS 0.3%CVE-2026-11391MEDIUMTanium addressed a SQL injection vulnerability in Patch.EPSS 0.3%CVE-2023-45256MEDIUMMultiple SQL injection vulnerabilities in the EuroInformation MoneticoPaiement module before 1.1.1 for PrestaShop allow remote attackers to EPSS 0.3%CVE-2026-101091HIGHSiYuan before v3.8.4 SQL Injection via Block Query EmbedEPSS 0.3%CVE-2025-45871HIGHLogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticatedEPSS 0.3%CVE-2026-100847HIGHAzuraCast before 0.23.8 DQL Injection via sortOrderEPSS 0.3%CVE-2026-48136MEDIUMAuthenticated Administrator Role-Based Access Control Bypass in ComplianceEPSS 0.3%CVE-2026-105889CRITICALWordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-46053MEDIUMA SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting aEPSS 0.3%CVE-2022-36839MEDIUMSQL injection vulnerability via IAPService in Samsung Checkout prior to version 5.0.53.1 allows attackers to access IAP information.EPSS 0.3%CVE-2026-96803MEDIUMjava110 MicroCommunity fallBack API Endpoint BusinessApi.java QueryServiceSMOImpl.fallBack sql injectionEPSS 0.3%CVE-2026-111990MEDIUMkishan0725 Hospital Management System Appointment Cancellation admin-panel.php mysqli_query sql injectionEPSS 0.3%CVE-2025-10121MEDIUMuverif kami_list addbatch sql injectionEPSS 0.3%CVE-2026-108807MEDIUMkrupalshah EmployeeRecruitmentSystem Registration adminregister.php mysql_query sql injectionEPSS 0.3%CVE-2026-93621HIGHWordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-102616MEDIUMrisesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injectionEPSS 0.3%