Falhas do tipo CWE-89

13.083 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2025-0173MEDIUMSourceCodester Online Eyewear Shop view_order.php sql injectionEPSS 0.5%CVE-2024-6274MEDIUMlahirudanushka School Management System Attendance Report Page attendancelist.php sql injectionEPSS 0.5%CVE-2024-1839CRITICALIntrado 911 Emergency Gateway login form is vulnerable to an unauthenticated blind time-based SQL injection, which may allow an unauthenticaEPSS 0.5%CVE-2025-25775CRITICALCodeastro Bus Ticket Booking System v1.0 is vulnerable to SQL injection via the kodetiket parameter in /BusTicket-CI/tiket/cekorder.EPSS 0.5%CVE-2025-31553CRITICALWordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.1 - SQL Injection vulnerabilityEPSS 0.5%CVE-2022-3013MEDIUMSourceCodester Simple Task Managing System loginVaLidation.php sql injectionEPSS 0.5%CVE-2024-52474CRITICALWordPress Express Payments plugin <= 1.1.8 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-5589MEDIUMNetentsec NS-ASG Application Security Gateway sql injectionEPSS 0.5%CVE-2026-3287MEDIUMyoulaitech youlai-mall App-side Product Pagination Endpoint SpuController.java listPagedSpuForApp sql injectionEPSS 0.5%CVE-2023-52142HIGHWordPress Events Shortcodes & Templates For The Events Calendar Plugin <= 2.3.1 is vulnerable to SQL InjectionEPSS 0.5%CVE-2024-11213MEDIUMSourceCodester Best Employee Management System edit_role.php sql injectionEPSS 0.5%CVE-2023-52201HIGHWordPress pTypeConverter Plugin <= 0.2.8.1 is vulnerable to SQL InjectionEPSS 0.5%CVE-2025-5119MEDIUMEmlog Pro api_controller.php sql injectionEPSS 0.5%CVE-2024-37840HIGHSQL injection vulnerability in processscore.php in Itsourcecode Learning Management System Project In PHP With Source Code v1.0 allows remotEPSS 0.5%CVE-2026-54350CRITICALBudibase: Anonymous NoSQL operator injection via published-app query templatesEPSS 0.5%CVE-2024-54361CRITICALWordPress Instant Appointment plugin <= 1.2 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-55977CRITICALWordPress LaunchPage.app Importer plugin <= 1.1 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-12938MEDIUMcode-projects Simple Admin Panel updateOrderStatus.php sql injectionEPSS 0.5%CVE-2019-25510HIGHJettweb PHP Hazir Haber Sitesi Scripti V2 Authentication BypassEPSS 0.5%CVE-2025-65950CRITICALWBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups[] ParameterEPSS 0.5%