Fallos del tipo CWE-89

12.874 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2022-39179HIGHCollege Management System v1.0 - Authenticated remote code executionEPSS 1.1%CVE-2020-20491HIGHSQL injection vulnerability in OpenCart v.2.2.00 thru 3.0.3.2 allows a remote attacker to execute arbitrary code via the Fba plugin functionEPSS 1.1%CVE-2020-21400HIGHSQL injection vulnerability in gaozhifeng PHPMyWind v.5.6 allows a remote attacker to execute arbitrary code via the id variable in the modiEPSS 1.1%CVE-2024-8944MEDIUMcode-projects Hospital Management System check_availability.php sql injectionEPSS 1.1%CVE-2025-59499HIGHMicrosoft SQL Server Elevation of Privilege VulnerabilityEPSS 1.1%CVE-2022-2214MEDIUMSourceCodester Library Management System bookdetails.php sql injectionEPSS 1.1%CVE-2022-3300HIGHForm Maker by 10Web < 1.15.6 - Admin+ SQLIEPSS 1.1%CVE-2024-2014HIGHPanabit Panalog sprog_upstatus.php sql injectionEPSS 1.1%CVE-2022-3246HIGHBlog2Social < 6.9.10 - Subscriber+ SQLiEPSS 1.1%CVE-2021-42333HIGHHuachu Digital Technology Co.,Ltd. Easytest - SQL Injection-1EPSS 1.1%CVE-2021-42334HIGHHuachu Digital Technology Co.,Ltd. Easytest - SQL Injection-2EPSS 1.1%CVE-2024-55573CRITICALAn issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.EPSS 1.1%CVE-2022-24831HIGHImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in OpenClinicaEPSS 1.1%CVE-2022-24848HIGHSQL Injection in DHIS2's in OrgUnit program associationEPSS 1.1%CVE-2017-20104HIGHSimplessus Cookie Time sql injectionEPSS 1.1%CVE-2023-37177CRITICALSQL Injection vulnerability in PMB Services PMB v.7.4.7 and before allows a remote unauthenticated attacker to execute arbitrary code via thEPSS 1.1%CVE-2021-3935—When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection iEPSS 1.1%CVE-2021-41433CRITICALSQL Injection vulnerability exists in version 1.0 of the Resumes Management and Job Application Website application login form by EGavilan MEPSS 1.1%CVE-2022-40943CRITICALDairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via bwdate-report-ds.php file.EPSS 1.1%CVE-2025-47608CRITICALWordPress Recover abandoned cart for WooCommerce plugin <= 2.5 - SQL Injection VulnerabilityEPSS 1.1%