Fallos del tipo CWE-89

13.404 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-47132MEDIUMphpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User EnumerationEPSS 0.3%CVE-2026-23706MEDIUMAn Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet ForEPSS 0.3%CVE-2026-48134MEDIUMSQL injection issue in UserCheck Portal when DLP Software Blade is activeEPSS 0.3%CVE-2025-31044HIGHWordPress Premium SEO Pack <= 3.3.2 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-114251MEDIUMitsourcecode Sales-and-Inventory-System cust_del.php sql injectionEPSS 0.3%CVE-2025-30628HIGHWordPress Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) plugin <= 1.2 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-68056HIGHWordPress LBG Zoominoutslider plugin <= 5.4.4 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-64371HIGHWordPress Traveler theme < 3.2.6 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-2503MEDIUMElementCamp <= 2.3.6 - Authenticated (Author+) SQL Injection via 'meta_query[compare]' ParameterEPSS 0.3%CVE-2026-102796HIGHUnauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parametersEPSS 0.3%CVE-2026-105388MEDIUMfeelec-yishu feelcrm-os Member Endpoint MemberController.class.php index sql injectionEPSS 0.3%CVE-2026-103116MEDIUMOS4ED openSIS-Classic Student List Search Endpoint GetStuListFnc.php DBQuery sql injectionEPSS 0.3%CVE-2026-10296MEDIUMitsourcecode Fees Management System ajax.php sql injectionEPSS 0.3%CVE-2026-103355CRITICALWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-22743HIGHServer-Side Request Forgery via Filter Expression Keys in Neo4jVectorStoreEPSS 0.3%CVE-2026-112087MEDIUMitsourcecode Online Cake Ordering System confirm.php sql injectionEPSS 0.3%CVE-2025-43923MEDIUMAn issue was discovered in ReportController in Unicom Focal Point 7.6.1. A user who has administrative privilege in Focal Point can perform EPSS 0.3%CVE-2026-95605CRITICALWordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-10242MEDIUMitsourcecode Content Management System instructions.php sql injectionEPSS 0.3%CVE-2026-76270MEDIUMStructured Query Language (SQL) Injection in the SPL2 Module Catalog in Splunk EnterpriseEPSS 0.3%