Fallos del tipo CWE-89

12.874 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2024-37906CRITICALAdmidio has Blind SQL Injection in ecard_send.phpEPSS 0.9%CVE-2024-29303CRITICALThe delete admin users function of SourceCodester PHP Task Management System 1.0 is vulnerable to SQL InjectionEPSS 0.9%CVE-2023-33331HIGHWordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to SQL InjectionEPSS 0.9%CVE-2024-10845MEDIUM1000 Projects Bookstore Management System book_detail.php sql injectionEPSS 0.9%CVE-2023-0917HIGHSourceCodester Simple Customer Relationship Management System login.php sql injectionEPSS 0.9%CVE-2023-41891LOWFlyteAdmin SQL Injection in List FiltersEPSS 0.9%CVE-2024-10844MEDIUM1000 Projects Bookstore Management System search.php sql injectionEPSS 0.9%CVE-2021-43830HIGHSQL injection in OpenProjectEPSS 0.9%CVE-2020-5320CRITICALDell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a SQLEPSS 0.9%CVE-2023-24840HIGHHGiga MailSherlock - SQL InjectionEPSS 0.9%CVE-2023-4188CRITICALSQL Injection in instantsoft/icms2EPSS 0.9%CVE-2024-32369MEDIUMSQL Injection vulnerability in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a remote attacker to obtain sensitive inforEPSS 0.9%CVE-2022-30998CRITICALWordPress Homepage Product Organizer for WooCommerce plugin <= 1.1 - Multiple Authenticated SQL Injection (SQLi) vulnerabilitiesEPSS 0.9%CVE-2022-47865CRITICALLead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeOrder.php.EPSS 0.9%CVE-2021-32474—An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this reEPSS 0.9%CVE-2023-28663HIGHThe Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injection vulnerability in the ‘fieldmap’ paramEPSS 0.9%CVE-2025-5298MEDIUMCampcodes Online Hospital Management System betweendates-detailsreports.php sql injectionEPSS 0.9%CVE-2022-47861CRITICALLead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeLead.php.EPSS 0.9%CVE-2023-31433HIGHA SQL injection issue in Logbuch in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 allows authenticated attackers to execute SQLEPSS 0.9%CVE-2022-47770CRITICALSerenissima Informatica Fast Checkin version v1.0 is vulnerable to Unauthenticated SQL Injection.EPSS 0.9%