Fallos del tipo CWE-89

13.406 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2019-25746HIGHWordPress Sliced Invoices 3.8.2 SQL Injection via post ParameterEPSS 0.2%CVE-2024-51102MEDIUMPHPGURUKUL Student Management System using PHP and MySQL v1 was discovered to contain multiple SQL injection vulnerabilities at /studentrecoEPSS 0.2%CVE-2026-63314HIGHSQL Injection in WebCTIEPSS 0.2%CVE-2026-111389HIGHFrappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing ValidationEPSS 0.2%CVE-2026-58225LOWSQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of serviceEPSS 0.2%CVE-2026-16593MEDIUMWP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget SettingsEPSS 0.2%CVE-2026-16596MEDIUMWP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' ParameterEPSS 0.2%CVE-2025-45021MEDIUMA SQL Injection vulnerability was identified in the admin/edit-directory.php file of the PHPGurukul Directory Management System v2.0. AttackEPSS 0.2%CVE-2025-63740MEDIUMSQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain senEPSS 0.2%CVE-2025-46154HIGHFoxcms v1.25 has a SQL time injection in the $_POST['dbname'] parameter of installdb.php.EPSS 0.2%CVE-2025-51045MEDIUMPhpgurukul Pre-School Enrollment System 1.0 contains a SQL injection vulnerability in the /admin/password-recovery.php file. This vulnerabilEPSS 0.2%CVE-2025-63948MEDIUMA SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute arbitrary SQL commandsEPSS 0.2%CVE-2025-51044MEDIUMphpgurukul Nipah virus (NiV) Testing Management System 1.0 contains a SQL injection vulnerability in the /new-user-testing.php file, due to EPSS 0.2%CVE-2025-68914MEDIUMRiello UPS NetMan 208 Application before 1.12 allows cgi-bin/login.cgi username SQL Injection. For example, an attacker can delete the LOGINEPSS 0.2%CVE-2026-108125HIGHWordPress Post Author Authenticated SQLiEPSS 0.2%CVE-2026-32687HIGHSQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3EPSS 0.2%CVE-2024-12706LOWSQL Injection vulnerability discovered in OpenText™ Digital Asset Management.EPSS 0.2%CVE-2025-60266MEDIUMIn xckk v9.6, there is a SQL injection vulnerability in which the orderBy parameter in address/list is not securely filtered, resulting in aEPSS 0.2%CVE-2022-20517MEDIUMIn getMessagesByPhoneNumber of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead toEPSS 0.2%CVE-2016-20063HIGHSingle Personal Message 1.0.3 WordPress Plugin SQL InjectionEPSS 0.2%