Falhas do tipo CWE-89

12.895 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2023-5439HIGHWp photo text slider 50 <= 8.0 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-5438HIGHwp image slideshow <= 12.0 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-5434HIGHSuperb slideshow gallery <= 13.1 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-5464HIGHJquery accordion slideshow <= 8.1 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-5435HIGHUp down image slideshow gallery <= 12.0 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-5436HIGHVertical marquee plugin <= 7.1 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-5437HIGHWP fade in text news <= 12.0 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2024-28322CRITICALSQL Injection vulnerability in /event-management-master/backend/register.php in PuneethReddyHC Event Management 1.0 allows attackers to run EPSS 0.8%CVE-2022-44399CRITICALPoultry Farm Management System v1.0 contains a SQL injection vulnerability via the del parameter at /Redcock-Farm/farm/category.php.EPSS 0.8%CVE-2021-38217CRITICALSEMCMS v 1.2 is vulnerable to SQL Injection via SEMCMS_User.php.EPSS 0.8%CVE-2022-44139CRITICALApartment Visitor Management System v1.0 is vulnerable to SQL Injection via /avms/index.php.EPSS 0.8%CVE-2022-43135CRITICALOnline Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /diagnostEPSS 0.8%CVE-2022-2018MEDIUMSourceCodester Prison Management System Inmate sql injectionEPSS 0.8%CVE-2024-29302HIGHSourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection via update-employee.php.EPSS 0.8%CVE-2014-125091MEDIUMcodepeople cp-polls Plugin cp-admin-int-message-list.inc.php sql injectionEPSS 0.8%CVE-2025-3690MEDIUMPHPGurukul Men Salon Management System edit-services.php sql injectionEPSS 0.8%CVE-2024-7219MEDIUMSourceCodester/Campcodes School Log Management System ajax.php sql injectionEPSS 0.8%CVE-2023-2050MEDIUMCampcodes Advanced Online Voting System positions_add.php sql injectionEPSS 0.8%CVE-2023-4449MEDIUMSourceCodester Free and Open Source Inventory Management System sql injectionEPSS 0.8%CVE-2023-30077CRITICALJudging Management System v1.0 by oretnom23 was discovered to vulnerable to SQL injection via /php-jms/review_result.php?mainevent_id=, mainEPSS 0.8%