Fallos del tipo CWE-89

13.416 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-28576CRITICALIn Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disEPSS 0.2%CVE-2024-33501MEDIUMTwo improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in Fortinet FortiAnalyzer veEPSS 0.2%CVE-2024-55159MEDIUMGFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the SortName parameter at /system/loginLog/list.EPSS 0.2%CVE-2026-40131LOWSQL Injection vulnerability in SAP HANA Deployment Infrastructure (HDI) deploy libraryEPSS 0.2%CVE-2026-6638LOWPostgreSQL REFRESH PUBLICATION allows SQL injection via table nameEPSS 0.2%CVE-2026-51936LOWZetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher_export convenience function can be used to copy the contents of one attaEPSS 0.2%CVE-2024-12913HIGHSQLi in Megatek Communication System's Azora Wireless Network ManagementEPSS 0.2%CVE-2026-15829HIGHSQL Injection and Security Boundary Bypass in googleapis/mcp-toolboxEPSS 0.2%CVE-2026-101046LOWFleet before 4.89.0 SQL Injection via ORDER BY Activity EndpointsEPSS 0.2%CVE-2025-6230MEDIUMA SQL injection vulnerability was reported in Lenovo Vantage that could allow a local attacker to modify the local SQLite database and execuEPSS 0.2%CVE-2026-94348MEDIUMDell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQEPSS 0.2%CVE-2026-87938—CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136EPSS 0.2%CVE-2025-52646LOWHCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries.EPSS 0.1%CVE-2026-89303MEDIUMPost Voting System <= 1.0 - Subscriber+ SQLi via 'row' ParameterEPSS 0.1%CVE-2025-55703LOWAn error-based SQL injection vulnerability exists in the Sunbird Power IQ 9.2.0 API. The vulnerability is due to an outdated API endpoint thEPSS 0.1%CVE-2024-14025LOWVideo StationEPSS 0.1%CVE-2025-49211HIGHA SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affectedEPSS 0.1%CVE-2025-49218HIGHA post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges oEPSS 0.1%CVE-2026-11475MEDIUMKushan2k student-management-system Certificate Verification Endpoint GradeController.php getStatus sql injectionEPSS 0.1%CVE-2026-1907HIGHSQL Injection in Clustering Communication (Hybrid Mode)EPSS 0.1%