Falhas do tipo CWE-89

13.084 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2025-3142MEDIUMSourceCodester Apartment Visitor Management System add-apartment.php sql injectionEPSS 0.5%CVE-2023-5293MEDIUMECshop leancloud.php sql injectionEPSS 0.5%CVE-2024-50713CRITICALSmartAgent v1.1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tests/interface.php.EPSS 0.5%CVE-2026-4112HIGHImproper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote EPSS 0.5%CVE-2025-2736MEDIUMPHPGurukul Old Age Home Management System bwdates-report-details.php sql injectionEPSS 0.5%CVE-2026-73721HIGHAuthenticated SQL Injection Vulnerabilities in HPE Networking Fabric ComposerEPSS 0.5%CVE-2025-3267MEDIUMqinguoyi TinyWebServer http_conn.cpp sql injectionEPSS 0.5%CVE-2024-2588HIGHSQL injection vulnerability in AMSS++EPSS 0.5%CVE-2025-2381MEDIUMPHPGurukul Curfew e-Pass Management System search-pass.php sql injectionEPSS 0.5%CVE-2025-2362MEDIUMPHPGurukul Pre-School Enrollment System contact-us.php sql injectionEPSS 0.5%CVE-2024-10427MEDIUMCodezips Pet Shop Management System deleteanimal.php sql injectionEPSS 0.5%CVE-2025-2379MEDIUMPHPGurukul Apartment Visitors Management System create-pass.php sql injectionEPSS 0.5%CVE-2024-7454MEDIUMSourceCodester Clinics Patient Management System patients.php patient_name sql injectionEPSS 0.5%CVE-2025-2735MEDIUMPHPGurukul Old Age Home Management System add-services.php sql injectionEPSS 0.5%CVE-2025-2739MEDIUMPHPGurukul Old Age Home Management System manage-services.php sql injectionEPSS 0.5%CVE-2025-2380MEDIUMPHPGurukul Apartment Visitors Management System admin-profile.php sql injectionEPSS 0.5%CVE-2024-57633HIGHAn issue in the exps_bind_column component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL stEPSS 0.5%CVE-2024-10734MEDIUMProject Worlds Life Insurance Management System editPayment.php sql injectionEPSS 0.5%CVE-2024-6416MEDIUMSeaCMS sql injectionEPSS 0.5%CVE-2025-2847MEDIUMCodezips Gym Management System over_month.php sql injectionEPSS 0.5%