Falhas do tipo CWE-89

13.072 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2024-51606HIGHWordPress Blrt WP Embed plugin <= 1.6.9 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-22283HIGHWordPress Delhivery Logistics Courier Plugin <= 1.0.107 is vulnerable to SQL InjectionEPSS 0.5%CVE-2025-4900MEDIUMCampcodes Sales and Inventory System payment.php sql injectionEPSS 0.5%CVE-2024-12785MEDIUMitsourcecode Vehicle Management System sendmail.php sql injectionEPSS 0.5%CVE-2026-31871CRITICALParse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQLEPSS 0.5%CVE-2025-1962MEDIUMprojectworlds Online Hotel Booking addroom.php sql injectionEPSS 0.5%CVE-2023-45860MEDIUMIn Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises froEPSS 0.5%CVE-2023-46084HIGHWordPress Icons Font Loader Plugin <= 1.1.2 is vulnerable to SQL InjectionEPSS 0.5%CVE-2025-4899MEDIUMCampcodes Sales and Inventory System transaction_update.php sql injectionEPSS 0.5%CVE-2025-1857MEDIUMPHPGurukul Nipah Virus Testing Management System check_availability.php sql injectionEPSS 0.5%CVE-2024-5893MEDIUMSourceCodester Cab Management System sql injectionEPSS 0.5%CVE-2024-10136MEDIUMcode-projects Pharmacy Management System manage_invoice.php sql injectionEPSS 0.5%CVE-2024-10137MEDIUMcode-projects Pharmacy Management System manage_medicine.php sql injectionEPSS 0.5%CVE-2024-9327MEDIUMcode-projects Blood Bank System forgot.php sql injectionEPSS 0.5%CVE-2025-4895MEDIUMSourceCodester Doctors Appointment System delete-session.php sql injectionEPSS 0.5%CVE-2024-12007MEDIUMcode-projects Farmacia visualizar-produto.php sql injectionEPSS 0.5%CVE-2023-52204HIGHWordPress Randomize Plugin <= 1.4.3 is vulnerable to SQL InjectionEPSS 0.5%CVE-2024-51608HIGHWordPress AmaDiscount Plugin plugin <= 1.0 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-4865MEDIUMitsourcecode Restaurant Management System member_save.php sql injectionEPSS 0.5%CVE-2024-7190MEDIUMitsourcecode Society Management System get_price.php sql injectionEPSS 0.5%