Fallos del tipo CWE-89

12.811 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-46906HIGHWhatsUp Gold GetSqlWhereClause SQL Injection Privilege Escalation VulnerabilityEPSS 40.4%CVE-2024-50330CRITICALSQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthentEPSS 40.3%CVE-2021-20016CRITICALA SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to accessEPSS 40.0%KEVCVE-2024-36465HIGHSQL injection in Zabbix APIEPSS 39.9%CVE-2025-61675HIGHFreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parametersEPSS 38.5%CVE-2021-3817CRITICALSQL Injection in wbce/wbce_cmsEPSS 38.4%CVE-2022-2754—Ketchup Restaurant Reservations <= 1.0.0 - Unauthenticated Blind SQLiEPSS 38.3%CVE-2021-24750—WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL InjectionEPSS 38.3%CVE-2022-46443HIGHmesinkasir Bangresto 1.0 is vulnberable to SQL Injection via the itemqty%5B%5D parameter.EPSS 37.7%CVE-2024-40638HIGHGLPI allows account takeover via SQL Injection in AJAX scriptsEPSS 37.4%CVE-2022-0739—BookingPress < 1.0.11 - Unauthenticated SQL InjectionEPSS 37.2%CVE-2022-1905—Events Made Easy < 2.2.81 - Unauthenticated SQLiEPSS 37.1%CVE-2024-4434CRITICALLearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL InjectionEPSS 36.9%CVE-2025-25064HIGHSQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 dEPSS 36.7%CVE-2024-45622CRITICALASIS (aka Aplikasi Sistem Sekolah using CodeIgniter 3) 3.0.0 through 3.2.0 allows index.php username SQL injection for Authentication BypassEPSS 36.7%CVE-2024-51482CRITICALBoolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64EPSS 36.6%CVE-2025-36527HIGHSQL InjectionEPSS 36.5%CVE-2025-32814CRITICALAn issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur.EPSS 36.4%CVE-2023-1454MEDIUMjeecg-boot qurestSql sql injectionEPSS 35.8%CVE-2024-5315CRITICALMultiple vulnerabilities in DOLIBARR's ERP CMSEPSS 34.5%