Fallos del tipo CWE-89

12.874 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2022-43530HIGHVulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQEPSS 1.0%CVE-2023-38825CRITICALSQL injection vulnerability in Vanderbilt REDCap before v.13.8.0 allows a remote attacker to obtain sensitive information via the password rEPSS 1.0%CVE-2022-43519HIGHMultiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remEPSS 1.0%CVE-2022-43523HIGHMultiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remEPSS 1.0%CVE-2022-1361HIGHCambium Networks cnMaestro SQL InjectionEPSS 0.9%CVE-2018-25075MEDIUMkarsany OBridge ProcedureDao.java getAllStandaloneProcedureAndFunction sql injectionEPSS 0.9%CVE-2024-3769HIGHPHPGurukul Student Record System login.php sql injectionEPSS 0.9%CVE-2022-1082HIGHSourceCodester Microfinance Management System Login Page login.php sql injectionEPSS 0.9%CVE-2022-1083HIGHMicrofinance Management System sql injectionEPSS 0.9%CVE-2024-4798MEDIUMSourceCodester Online Computer and Laptop Store manage_brand.php sql injectionEPSS 0.9%CVE-2023-51828CRITICALA SQL Injection vulnerability in /admin/convert/export.class.php in PMB 7.4.7 and earlier versions allows remote unauthenticated attackers tEPSS 0.9%CVE-2022-23767HIGHSecureGate authentication bypass vulnerabilityEPSS 0.9%CVE-2023-2073HIGHCampcodes Online Traffic Offense Management System Login.php sql injectionEPSS 0.9%CVE-2026-9786HIGHQuest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-9785HIGHQuest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-9781HIGHQuest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-7570HIGHQuest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-9783HIGHQuest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-9782HIGHQuest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-9784HIGHQuest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution VulnerabilityEPSS 0.9%