Fallos del tipo CWE-89

12.874 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-8868MEDIUMcode-projects Crud Operation System savedata.php sql injectionEPSS 0.9%CVE-2023-2756MEDIUM SQL Injection in pimcore/customer-data-frameworkEPSS 0.9%CVE-2024-0268HIGHKashipara Hospital Management System registration.php sql injectionEPSS 0.9%CVE-2022-40839HIGHA SQL injection vulnerability in the height and width parameter in NdkAdvancedCustomizationFields v3.5.0 allows unauthenticated attackers toEPSS 0.9%CVE-2019-19094HIGHABB eSOMS: SQL injection vulnerabilityEPSS 0.9%CVE-2022-2137MEDIUMAdvantech iViewEPSS 0.9%CVE-2026-3180HIGHContest Gallery <= 28.1.4 - Unauthenticated SQL InjectionEPSS 0.9%CVE-2023-49030HIGHSQL Injection vulnerability in32ns KLive v.2019-1-19 and before allows a remote attacker to obtain sensitive information via a crafted scripEPSS 0.9%CVE-2020-8242—Unsanitized user input in ExpressionEngine <= 5.4.0 control panel member creation leads to an SQL injection. The user needs member creation/EPSS 0.9%CVE-2023-23279CRITICALCanteen Management System 1.0 is vulnerable to SQL Injection via /php_action/getOrderReport.php.EPSS 0.9%CVE-2022-0983—An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachEPSS 0.9%CVE-2023-27742CRITICALIDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login.EPSS 0.9%CVE-2022-47780CRITICALSQL Injection vulnerability in Bangresto 1.0 via the itemID parameter.EPSS 0.9%CVE-2026-41167CRITICALJellystat has SQL Injection that leads to to Remote Code ExecutionEPSS 0.9%CVE-2022-2298HIGHSourceCodester Clinics Patient Management System Login Page index.php sql injectionEPSS 0.9%CVE-2022-43437HIGHHWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - SQL InjectionEPSS 0.9%CVE-2022-43214CRITICALBilling System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at printOrder.php.EPSS 0.9%CVE-2024-7637MEDIUMcode-projects Online Polling Registration registeracc.php sql injectionEPSS 0.9%CVE-2023-6054MEDIUMTongda OA 2017 lock.php sql injectionEPSS 0.9%CVE-2024-37906CRITICALAdmidio has Blind SQL Injection in ecard_send.phpEPSS 0.9%