Fallos del tipo CWE-89

13.405 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-25239HIGHPEAR is Vulnerable to SQL Injection in apidoc_queue Insert via Unescaped FilenameEPSS 0.2%CVE-2025-61194MEDIUMdaicuocms V1.3.13 contains a SQL injection vulnerability in the file library\think\db\Builder.php.EPSS 0.2%CVE-2025-51969MEDIUMA SQL Injection vulnerability exists in the product.php page of PuneethReddyHC Online Shopping System Advanced 1.0. This flaw is present in EPSS 0.2%CVE-2024-33161MEDIUMJ2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the unallocatedList() function.EPSS 0.2%CVE-2026-24367HIGHWordPress Traveler theme < 3.2.8 - SQL Injection vulnerabilityEPSS 0.2%CVE-2025-68053HIGHWordPress xPromoter plugin <= 1.3.4 - SQL Injection vulnerabilityEPSS 0.2%CVE-2025-29640MEDIUMPhpgurukul Human Metapneumovirus (HMPV) – Testing Management System v1.0 is vulnerable to SQL Injection in /patient-report.php via the paramEPSS 0.2%CVE-2026-96809CRITICALWordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerabilityEPSS 0.2%CVE-2025-69351HIGHWordPress Ninja Tables plugin <= 5.2.4 - SQL Injection vulnerabilityEPSS 0.2%CVE-2025-68054HIGHWordPress CountDown With Image or Video Background plugin <= 1.5 - SQL Injection vulnerabilityEPSS 0.2%CVE-2025-28949HIGHWordPress Mediabay - WordPress Media Library Folders <= 1.4 - SQL Injection VulnerabilityEPSS 0.2%CVE-2024-11025MEDIUMSMA: SQL injection in Sunny Central UPEPSS 0.2%CVE-2026-96331CRITICALWordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-95868MEDIUMAdithyaYelloju Restaurant-Management-System Search Form display_menu.php mysqli_query sql injectionEPSS 0.2%CVE-2025-53122MEDIUMSQLi in OpenNMS Horizon and MeridianEPSS 0.2%CVE-2025-70311MEDIUMJEEWMS 1.0 is vulnerable to SQL Injection. Attackers can inject malicious SQL statements through the id1 and id2 parameters in the /systemCoEPSS 0.2%CVE-2025-48701MEDIUMopenDCIM through 23.04 allows SQL injection in people_depts.php because prepared statements are not used.EPSS 0.2%CVE-2026-110651MEDIUMSwift Performance Lite < 2.3.7.4 - Author+ SQLi via Image OptimizerEPSS 0.2%CVE-2026-15600HIGHSQL Injection in Alior Bank raty PrestaShop moduleEPSS 0.2%CVE-2026-112327CRITICALWordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerabilityEPSS 0.2%