Falhas do tipo CWE-89

13.079 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2023-0980MEDIUMSourceCodester Yoga Class Registration System Status Update update_status.php sql injectionEPSS 0.5%CVE-2023-3657MEDIUMSourceCodester AC Repair and Services System HTTP POST Request sql injectionEPSS 0.5%CVE-2023-50845HIGHWordPress GeoDirectory Plugin <= 2.3.28 is vulnerable to SQL InjectionEPSS 0.5%CVE-2023-1466MEDIUMSourceCodester Student Study Center Desk Management System view_student sql injectionEPSS 0.5%CVE-2023-0982MEDIUMSourceCodester Yoga Class Registration System Add Class Entry sql injectionEPSS 0.5%CVE-2025-26200HIGHSQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month parameter in the visitor_report_day.php componeEPSS 0.5%CVE-2024-25902HIGHWordPress Malware Scanner Plugin <= 4.7.2 is vulnerable to SQL InjectionEPSS 0.5%CVE-2024-10446MEDIUMProject Worlds Online Time Table Generator admindashboard.php sql injectionEPSS 0.5%CVE-2023-50854HIGHWordPress Squirrly SEO - Advanced Pack Plugin <= 2.3.8 is vulnerable to SQL InjectionEPSS 0.5%CVE-2024-5981MEDIUMitsourcecode Online House Rental System manage_user.php sql injectionEPSS 0.5%CVE-2018-25204HIGHLibrary CMS 1.0 SQL Injection via admin loginEPSS 0.5%CVE-2023-3661MEDIUMSourceCodester AC Repair and Services System sql injectionEPSS 0.5%CVE-2024-31116HIGHWordPress 10Web Map Builder for Google Maps plugin <= 1.0.74 - SQL Injection vulnerabilityEPSS 0.5%CVE-2023-3658MEDIUMSourceCodester AC Repair and Services System HTTP POST Request sql injectionEPSS 0.5%CVE-2023-50848HIGHWordPress 404 Solution Plugin <= 2.34.0 is vulnerable to SQL InjectionEPSS 0.5%CVE-2023-1468MEDIUMSourceCodester Student Study Center Desk Management System Report sql injectionEPSS 0.5%CVE-2023-1592MEDIUMSourceCodester Automatic Question Paper Generator System GET Parameter view_class.php sql injectionEPSS 0.5%CVE-2023-52134HIGHWordPress GEO my WordPress Plugin <= 4.0.2 is vulnerable to SQL InjectionEPSS 0.5%CVE-2024-4912MEDIUMCampcodes Online Examination System addExamExe.php sql injectionEPSS 0.5%CVE-2025-8376MEDIUMcode-projects Vehicle Management updatebal.php sql injectionEPSS 0.5%