Fallos del tipo CWE-89

12.877 resultados

Injeção de SQL

Ocorre quando dados fornecidos por um usuário são incorporados diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante modifique a lógica da consulta. O risco é grave: exposição de dados sensíveis, modificação ou deleção de registros, e até comprometimento do servidor de banco de dados.

Ejemplo

Um formulário de login que constrói a consulta como `SELECT * FROM users WHERE login = '` + entrada_do_usuario + `'` permite que alguém digite `admin' --` e contorne a verificação de senha, ou `' OR '1'='1` para listar todos os usuários.

Cómo mitigar

Use prepared statements ou stored procedures com parâmetros vinculados (nunca concatenação de strings). Se necessário filtrar, aplique whitelist rigorosa e escape adequado para o banco de dados específico. Implemente validação de entrada e princípio do menor privilégio na conta do banco.

CVE-2012-10009HIGH404like Plugin 404Like.php checkPage sql injectionEPSS 0.9%CVE-2026-42425HIGHOpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQueryEPSS 0.9%CVE-2022-43168CRITICALRukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reports_id parameter.EPSS 0.9%CVE-2023-2832HIGH SQL Injection in unilogies/bumsysEPSS 0.9%CVE-2023-3673HIGHSQL Injection in pimcore/pimcoreEPSS 0.9%CVE-2020-22819CRITICALMKCMS V6.2 has SQL injection via the /ucenter/active.php verify parameter.EPSS 0.9%CVE-2022-2142HIGHAdvantech iViewEPSS 0.9%CVE-2020-22818CRITICALMKCMS V6.2 has SQL injection via /ucenter/reg.php name parameter.EPSS 0.9%CVE-2024-7643MEDIUMSourceCodester Leads Manager Tool Delete Leads delete-leads.php sql injectionEPSS 0.9%CVE-2021-32957HIGHMDT AutoSave Uncontrolled Search Path ElementEPSS 0.9%CVE-2026-48842HIGHRoundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_reEPSS 0.9%CVE-2021-26644HIGHSQL-Injection vulnerability caused by the lack of verification of input values for the table name of DB used by the Mangboard bulletin boardEPSS 0.9%CVE-2022-43256CRITICALSeaCms before v12.6 was discovered to contain a SQL injection vulnerability via the component /js/player/dmplayer/dmku/index.php.EPSS 0.9%CVE-2020-22820CRITICALMKCMS V6.2 has SQL injection via the /ucenter/repass.php name parameter.EPSS 0.9%CVE-2023-1606MEDIUMnovel-plus DictController.java sql injectionEPSS 0.9%CVE-2022-47866CRITICALLead management system v1.0 is vulnerable to SQL Injection via the id parameter in removeBrand.php.EPSS 0.9%CVE-2022-47860CRITICALLead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeProduct.php.EPSS 0.9%CVE-2023-0388HIGHRandom Text <= 0.3.0 - Subscriber+ SQLiEPSS 0.9%CVE-2024-1793HIGHAWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth By AWeber <= 7.3.14 - Authenticated (Admin+) SQL InjectionEPSS 0.9%CVE-2023-23331CRITICALAmano Xoffice parking solutions 7.1.3879 is vulnerable to SQL Injection.EPSS 0.9%