Falhas do tipo CWE-89

12.962 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2026-22620HIGHImproper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote aEPSS 0.7%CVE-2026-73069CRITICALTwenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL ExecutionEPSS 0.7%CVE-2026-78315HIGHDIAEnergie - SQL InjectionEPSS 0.7%CVE-2026-78314HIGHDIAEnergie - SQL InjectionEPSS 0.7%CVE-2025-66335MEDIUMApache Doris MCP Server: MCP SQL injectEPSS 0.7%CVE-2026-56287HIGHApache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File DisclosureEPSS 0.7%CVE-2025-32859HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2024-7273MEDIUMitsourcecode Alton Management System search.php sql injectionEPSS 0.7%CVE-2025-32856HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2024-35355CRITICALA vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the EPSS 0.7%CVE-2025-36588HIGHDell Unisphere for PowerMax, version(s) 10.2.0.x, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL InjEPSS 0.7%CVE-2025-32860HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2024-34256CRITICALOFCMS V1.1.2 is vulnerable to SQL Injection via the new table function.EPSS 0.7%CVE-2023-47558HIGHWordPress Who Hit The Page – Hit Counter Plugin <= 1.4.14.3 is vulnerable to SQL InjectionEPSS 0.7%CVE-2025-32855HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2025-32863HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2026-26794HIGHGL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() function. This vulnerability allows EPSS 0.7%CVE-2025-32858HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2025-32861HIGHA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injEPSS 0.7%CVE-2024-25894CRITICALChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EventCount POST parameter.EPSS 0.7%