Fallos del tipo CWE-89

13.409 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-11584MEDIUMCodeAstro Student Attendance Management System createClass.php edit sql injectionEPSS 0.2%CVE-2025-65379MEDIUMPHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the /admin/password-recovery.php endpoint. Specifically, the username and moEPSS 0.2%CVE-2026-10265MEDIUMitsourcecode Content Management System edit_topic.php sql injectionEPSS 0.2%CVE-2025-65380MEDIUMPHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the admin/index.php endpoint. Specifically, the username parameter accepts uEPSS 0.2%CVE-2026-10176MEDIUMAider-AI Aider Code Generation Workflow sql injectionEPSS 0.2%CVE-2026-11583MEDIUMCodeAstro Student Attendance Management System createClass.php sql injectionEPSS 0.2%CVE-2026-10286MEDIUMCodeAstro Payroll System home_employee.php sql injectionEPSS 0.2%CVE-2026-75786HIGHSQL Injection in Grafana Integration Endpoint (query.php)EPSS 0.2%CVE-2025-22976HIGHSQL Injection vulnerability in dingfanzuCMS v.1.0 allows a local attacker to execute arbitrary code via not filtering the content correctly EPSS 0.2%CVE-2025-67285HIGHA SQL injection vulnerability was found in the '/cts/admin/?page=zone' file of ITSourcecode COVID Tracking System Using QR-Code v1.0. The reEPSS 0.2%CVE-2018-25191HIGHFacturation System 1.0 SQL Injection via editar_producto.phpEPSS 0.2%CVE-2026-101011MEDIUMaaPanel BaoTa Domain domainMod.py get_domain_status sql injectionEPSS 0.2%CVE-2026-105146MEDIUMComsenz Discuz! Admin Medal Moderation mod.php modmedalsubmit sql injectionEPSS 0.2%CVE-2018-25180HIGHMaitra 1.7.2 SQL Injection and Database File DownloadEPSS 0.2%CVE-2026-101018MEDIUMdayrui XunruiCMS Group Editing Home.php group_all_edit sql injectionEPSS 0.2%CVE-2026-114266MEDIUMProjectWorlds Advanced Library Management System profile.php mysqli_query sql injectionEPSS 0.2%CVE-2025-67405HIGHSourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_password.php via the parameter new_password.EPSS 0.2%CVE-2026-95833MEDIUMitsourcecode Leave Management System index.php sql injectionEPSS 0.2%CVE-2026-11514MEDIUMitsourcecode Hospital Management System addpatient.php sql injectionEPSS 0.2%CVE-2026-103114MEDIUMOS4ED openSIS-Classic Assignment Management Endpoint Assignments.php DBQuery_assignment sql injectionEPSS 0.2%