Falhas do tipo CWE-89

13.085 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2023-4541CRITICALSQLi in Weens Admin PanelEPSS 0.5%CVE-2024-9315MEDIUMSourceCodester Employee and Visitor Gate Pass Logging System manage_department.php sql injectionEPSS 0.5%CVE-2026-27834HIGHPiwigo: SQL Injection in pwg.users.getList API Method via filter ParameterEPSS 0.5%CVE-2024-9317MEDIUMSourceCodester Online Eyewear Shop Master.php delete_category sql injectionEPSS 0.5%CVE-2026-27885HIGHPiwigo: SQL Injection in Activity.getListEPSS 0.5%CVE-2024-28145MEDIUMUnauthenticated SQL InjectionEPSS 0.5%CVE-2026-5577MEDIUMSong-Li cross_browser details Endpoint uniquemachine_app.py sql injectionEPSS 0.5%CVE-2024-6215MEDIUMSourceCodester Food Ordering Management System view-ticket-admin.php sql injectionEPSS 0.5%CVE-2024-44727HIGHSourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php.EPSS 0.5%CVE-2024-35350CRITICALA vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the EPSS 0.5%CVE-2024-3518HIGHMedia Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via ShortcodeEPSS 0.5%CVE-2024-8621CRITICALDaily Prayer Time <= 2024.08.26 - Authenticated (Contributor+) SQL InjectionEPSS 0.5%CVE-2026-12076CRITICALSQL Injection in Raytha CMSEPSS 0.5%CVE-2024-48411CRITICALitsourcecode Online Tours and Travels Management System v1.0 is vulnerable to SQL Injection (SQLI) via a crafted payload to the val-email paEPSS 0.5%CVE-2026-1593MEDIUMitsourcecode Society Management System edit_expenses_query.php sql injectionEPSS 0.5%CVE-2026-40906CRITICALElectric: SQL Injection via ORDER BY Parameter in Shape APIEPSS 0.5%CVE-2024-9574CRITICALSQL Injection vulnerability in SOPlanningEPSS 0.5%CVE-2024-12032MEDIUMTourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking <= 2.15.3 - Authenticated (Subscriber+) SQL InjectionEPSS 0.5%CVE-2026-57309CRITICALBlind SQL Injection in Windu CMSEPSS 0.5%CVE-2026-15067HIGHMultiple Security Vulnerabilities in Terraform Provider for Snowflake Could Allow Privilege Escalation and Unauthorized Snowflake Account TakeoverEPSS 0.5%