Fallos del tipo CWE-89

12.811 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2022-39323HIGHSQL Injection on REST API in GLPIEPSS 34.5%CVE-2022-0349—NotificationX < 2.3.9 - Unauthenticated Blind SQL InjectionEPSS 34.4%CVE-2021-36300MEDIUMiDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability. An unauthenticated remote attacker may potentially eEPSS 33.3%CVE-2023-30194CRITICALPrestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook().EPSS 32.4%CVE-2025-24587HIGHWordPress Email Subscription Popup plugin <= 1.2.23 - SQL Injection vulnerabilityEPSS 32.2%CVE-2023-4548MEDIUMSPA-Cart eCommerce CMS GET Parameter search sql injectionEPSS 32.2%CVE-2022-0651CRITICALWP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_typeEPSS 32.2%CVE-2024-30491HIGHWordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - SQL Injection vulnerabilityEPSS 32.0%CVE-2023-41320HIGHAccount takeover via SQL Injection in UI layout preferences in GLPIEPSS 31.9%CVE-2023-4708MEDIUMInfosoftbd Clcknshop GET Parameter all sql injectionEPSS 31.2%CVE-2023-43813MEDIUMglpi Authenticated SQL InjectionEPSS 30.9%CVE-2025-29085CRITICALSQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/eEPSS 30.7%CVE-2024-31077HIGHForminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authenticated attacker with EPSS 30.4%CVE-2021-20028CRITICALImproper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, sEPSS 30.1%KEVCVE-2021-24340—WP Statistics < 13.0.8 - Unauthenticated SQL InjectionEPSS 29.8%CVE-2020-13568HIGHSQL injection vulnerability exists in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HEPSS 29.7%CVE-2021-36299HIGHDell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability. A remote authenticEPSS 29.6%CVE-2024-39907CRITICALa sqlinjection in 1Panel EPSS 29.2%CVE-2023-34991CRITICALA improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and EPSS 28.8%CVE-2022-3323HIGHAn SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listEPSS 28.6%