Fallos del tipo CWE-89

12.877 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2023-31628HIGHAn issue in the stricmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQLEPSS 0.9%CVE-2023-31626HIGHAn issue in the gpf_notice component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted EPSS 0.9%CVE-2023-31614HIGHAn issue in the mp_box_deserialize_string function in openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoSEPSS 0.9%CVE-2023-31609HIGHAn issue in the dfe_unit_col_loci component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via cEPSS 0.9%CVE-2023-31625HIGHAn issue in the psiginfo component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQEPSS 0.9%CVE-2023-31608HIGHAn issue in the artm_div_int component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafteEPSS 0.9%CVE-2023-31621HIGHAn issue in the kc_var_col component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted EPSS 0.9%CVE-2023-31629HIGHAn issue in the sqlo_union_scope component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crEPSS 0.9%CVE-2023-31612HIGHAn issue in the dfe_qexp_list component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via craftEPSS 0.9%CVE-2023-31617HIGHAn issue in the dk_set_delete component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via craftEPSS 0.9%CVE-2023-4543MEDIUMIBOS OA export&contactids=x sql injectionEPSS 0.9%CVE-2023-27871HIGHIBM Aspera Faspex information disclosureEPSS 0.9%CVE-2023-29095HIGHWordPress RSVPMarker Plugin < 10.5.5 is vulnerable to SQL InjectionEPSS 0.9%CVE-2023-22319HIGHA sql injection vulnerability exists in the requestHandlers.js LoginAuth functionality of Milesight VPN v2.0.2. A specially-crafted network EPSS 0.9%CVE-2023-20010HIGHA vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications EPSS 0.9%CVE-2023-34168HIGHWordPress WP Report Post Plugin <= 2.1.2 is vulnerable to SQL InjectionEPSS 0.9%CVE-2023-4928HIGHSQL Injection in instantsoft/icms2EPSS 0.9%CVE-2023-27233HIGHPiwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php.EPSS 0.9%CVE-2022-40315CRITICALA limited SQL injection risk was identified in the "browse list of users" site administration page.EPSS 0.9%CVE-2023-5004CRITICALHospital-management-system-in-php 378c157 - Blind SQL InjectionEPSS 0.9%