Fallos del tipo CWE-89

13.605 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-24401CRITICALSQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitorinEPSS 45.9%CVE-2023-2114HIGHNEX-Forms < 8.4 - Admin+ SQL InjectionEPSS 44.9%CVE-2024-9379MEDIUMSQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to ruEPSS 44.3%KEVCVE-2023-0562HIGHPHPGurukul Bank Locker Management System Login index.php sql injectionEPSS 44.3%CVE-2022-0479—Popup Builder < 4.1.1 - SQL Injection to Reflected Cross-Site ScriptingEPSS 43.8%CVE-2024-32848CRITICALAn unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin pEPSS 43.4%CVE-2024-34783CRITICALAn unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin pEPSS 43.4%CVE-2022-1281—Photo Gallery < 1.6.3 - Unauthenticated SQL InjectionEPSS 43.4%CVE-2022-0773—Documentor <= 1.5.3 - Unauthenticated SQLiEPSS 43.3%CVE-2023-41887CRITICALRemote Code exec in project import with mysql jdbc url attackEPSS 42.5%CVE-2020-12271CRITICALA SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wildEPSS 42.4%KEVCVE-2023-28662CRITICALThe Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL injection vulnerabilitEPSS 42.2%CVE-2025-36527HIGHSQL InjectionEPSS 42.0%CVE-2023-29154HIGHSQL injection vulnerability exists in the CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user who can access the affected product witEPSS 41.4%CVE-2024-5723HIGHCentreon updateServiceHost SQL Injection Remote Code Execution VulnerabilityEPSS 40.7%CVE-2024-38289CRITICALA boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated EPSS 40.6%CVE-2023-1730CRITICALSupportCandy < 3.1.5 - Unauthenticated SQLiEPSS 40.6%CVE-2024-1601HIGHSQL Injection in parisneo/lollms-webuiEPSS 40.4%CVE-2024-46906HIGHWhatsUp Gold GetSqlWhereClause SQL Injection Privilege Escalation VulnerabilityEPSS 40.4%CVE-2025-61675HIGHFreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parametersEPSS 40.3%