Falhas do tipo CWE-89

13.083 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2024-40689MEDIUMIBM InfoSphere Information Server SQL injectionEPSS 0.5%CVE-2024-54361CRITICALWordPress Instant Appointment plugin <= 1.2 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-54234CRITICALWordPress Limit Login Attempts plugin <= 5.5 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-65950CRITICALWBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups[] ParameterEPSS 0.5%CVE-2021-43766—Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common Name for client autheEPSS 0.5%CVE-2024-55977CRITICALWordPress LaunchPage.app Importer plugin <= 1.1 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-2060MEDIUMPHPGurukul Emergency Ambulance Hiring Portal admin-profile.php sql injectionEPSS 0.5%CVE-2025-3143MEDIUMSourceCodester Apartment Visitor Management System visitor-entry.php sql injectionEPSS 0.5%CVE-2025-2050MEDIUMPHPGurukul User Registration & Login and User Management System login.php sql injectionEPSS 0.5%CVE-2025-2062MEDIUMprojectworlds Life Insurance Management System clientStatus.php sql injectionEPSS 0.5%CVE-2024-0462MEDIUMcode-projects Online Faculty Clearance HTTP POST Request designee_view_status.php sql injectionEPSS 0.5%CVE-2024-13184HIGHThe Ultimate WordPress Toolkit – WP Extended <= 3.0.12 - Unauthenticated SQL Injection via Login Attempts ModuleEPSS 0.5%CVE-2025-2063MEDIUMprojectworlds Life Insurance Management System deleteNominee.php sql injectionEPSS 0.5%CVE-2024-48040HIGHWordPress Tainacan plugin <= 0.21.8 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-2065MEDIUMprojectworlds Life Insurance Management System editAgent.php sql injectionEPSS 0.5%CVE-2024-7680MEDIUMitsourcecode Tailoring Management System incedit.php sql injectionEPSS 0.5%CVE-2024-53506CRITICALA SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs.EPSS 0.5%CVE-2024-1821MEDIUMcode-projects Crime Reporting System police_add.php sql injectionEPSS 0.5%CVE-2025-2034MEDIUMPHPGurukul Pre-School Enrollment System edit-class.php sql injectionEPSS 0.5%CVE-2025-2066MEDIUMprojectworlds Life Insurance Management System updateAgent.php sql injectionEPSS 0.5%