Fallos del tipo CWE-89

12.874 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2026-21708CRITICALA vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.EPSS 1.1%CVE-2025-0944MEDIUMitsourcecode Tailoring Management System customerview.php sql injectionEPSS 1.1%CVE-2019-3792MEDIUMConcourse 5.0.0 SQL Injection vulnerabilityEPSS 1.1%CVE-2024-49681CRITICALWordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.0.9 - SQL Injection vulnerabilityEPSS 1.1%CVE-2023-51210CRITICALSQL injection vulnerability in Webkul Bundle Product 6.0.1 allows a remote attacker to execute arbitrary code via the id_product parameters EPSS 1.1%CVE-2019-25515HIGHJettweb PHP Hazir Haber Sitesi Scripti V3 Authentication BypassEPSS 1.1%CVE-2025-45542HIGHSQL injection vulnerability in the registrationform endpoint of CloudClassroom-PHP-Project v1.0. The pass parameter is vulnerable due to impEPSS 1.1%CVE-2019-3797LOWAdditional information exposure with Spring Data JPA derived queriesEPSS 1.1%CVE-2026-48324CRITICALColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)EPSS 1.1%CVE-2026-27497CRITICALn8n has Potential Remote Code Execution via Merge NodeEPSS 1.1%CVE-2022-3243HIGHImport all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLiEPSS 1.1%CVE-2021-31869MEDIUMPimcore AdminBundle 'specificID' SQL InjectionEPSS 1.1%CVE-2021-1365HIGHCisco Unified Communications Manager IM & Presence Service SQL Injection VulnerabilitiesEPSS 1.1%CVE-2021-1363HIGHCisco Unified Communications Manager IM & Presence Service SQL Injection VulnerabilitiesEPSS 1.1%CVE-2024-42361HIGHGHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull}EPSS 1.1%CVE-2021-31849HIGHData Loss Prevention (DLP) ePO extension - SQL injectionEPSS 1.1%CVE-2021-21427CRITICALBackport for CVE-2021-21024 Blind SQLi from Magento 2EPSS 1.1%CVE-2024-31821HIGHSQL Injection vulnerability in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker tEPSS 1.1%CVE-2022-40097HIGHOnline Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_EPSS 1.1%CVE-2022-29411HIGHWordPress Hermit 音乐播放器 plugin <= 3.1.6 - Unauthenticated SQL Injection SQLi) vulnerabilityEPSS 1.1%