Fallos del tipo CWE-89

13.408 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2025-29744MEDIUMpg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers.EPSS 0.2%CVE-2018-25410HIGHSIM-PKH 2.4.1 SQL Injection via media.php id ParameterEPSS 0.2%CVE-2023-48645HIGHAn issue was discovered in the Archibus app 4.0.3 for iOS. It uses a local database that is synchronized with a Web central server instance EPSS 0.2%CVE-2022-20518MEDIUMIn query of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead to local information EPSS 0.2%CVE-2025-15585MEDIUMFileflows versions before 25.05.2 are affected by an authenticated SQL injection vulnerability in the library-file search function. SuccessfEPSS 0.2%CVE-2016-20063HIGHSingle Personal Message 1.0.3 WordPress Plugin SQL InjectionEPSS 0.2%CVE-2026-111700HIGHWebVella ERP through 1.8.8 SQL Injection via EQL Query APIEPSS 0.2%CVE-2026-108776—Apache Kylin: tables/names SparkSQL injectionEPSS 0.2%CVE-2025-8709HIGHSQL Injection in langchain-ai/langchainEPSS 0.2%CVE-2026-94124HIGHWordPress WP EasyCart plugin <= 5.9.4 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-89235MEDIUMTestimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated SQLi via 'offset' ParameterEPSS 0.2%CVE-2026-93773HIGHWordPress Mollie Forms plugin <= 2.11.0 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-89237MEDIUMBluff Post <= 1.1.1 - Unauthenticated SQLi via 'table_name' and 'column_name' ParametersEPSS 0.2%CVE-2026-88756MEDIUMPagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public logiEPSS 0.2%CVE-2023-40992MEDIUMHospital Management System 4 is vulnerable to a SQL injection in /Hospital-Management-System-master/func.php via the password2 parameter.EPSS 0.2%CVE-2022-42535MEDIUMIn a query in MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead to local informatioEPSS 0.2%CVE-2026-13746LOWSnowflake CLI SQL Injection Through Improper Neutralization of Local CLI ParametersEPSS 0.2%CVE-2026-85568MEDIUMUnlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQLi via 'ucs' ParameterEPSS 0.2%CVE-2025-30059MEDIUMAuthenticated SQL injection in PrepareCDExportJSON.plEPSS 0.2%CVE-2025-30061MEDIUMSQL injection in utils/Reporter/OpenReportWindow.pl via the UserID parameterEPSS 0.2%