Falhas do tipo CWE-89

13.065 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2025-1958MEDIUMaaluoxiang oa_system address-mapper.xml sql injectionEPSS 0.5%CVE-2025-0536MEDIUM1000 Projects Attendance Tracking Management System edit_action.php sql injectionEPSS 0.5%CVE-2024-2944MEDIUMCampcodes Online Examination System deleteCourseExe.php sql injectionEPSS 0.5%CVE-2023-25045MEDIUMWordPress RSVPMarker Plugin <= 9.9.3 is vulnerable to SQL InjectionEPSS 0.5%CVE-2026-13766CRITICALDBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiersEPSS 0.5%CVE-2024-10731MEDIUMTongda OA check_seal.php sql injectionEPSS 0.5%CVE-2024-2622MEDIUMFujian Kelixin Communication Command and Dispatch Platform editemedia.php sql injectionEPSS 0.5%CVE-2026-33288HIGHSuiteCRM has Authenticated SQL Injection in Authentication ModuleEPSS 0.5%CVE-2022-4961MEDIUMWeitong Mall OrderDao.xml sql injectionEPSS 0.5%CVE-2024-25288MEDIUMSLIMS (Senayan Library Management Systems) 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabolary.php.EPSS 0.5%CVE-2024-30242HIGHWordPress Contact Form to Any API plugin <= 1.1.8 - Auth. SQL Injection vulnerabilityEPSS 0.5%CVE-2026-27681CRITICALSQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business WarehouseEPSS 0.5%CVE-2023-33945MEDIUMSQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before updatEPSS 0.5%CVE-2026-71287HIGHCacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL InjectionEPSS 0.5%CVE-2024-30240HIGHWordPress Calendarista plugin <= 15.5.7 - SQL Injection vulnerabilityEPSS 0.5%CVE-2026-71288HIGHKoha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.plEPSS 0.5%CVE-2025-3676MEDIUMxxyopen Novel-Plus books sql injectionEPSS 0.5%CVE-2025-10596MEDIUMSourceCodester Online Exam Form Submission index.php sql injectionEPSS 0.5%CVE-2025-9418MEDIUMitsourcecode Apartment Management System addowner.php sql injectionEPSS 0.5%CVE-2025-9002MEDIUMSurbowl dormitory-management-php login.php sql injectionEPSS 0.5%