Falhas do tipo CWE-89

13.617 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2019-12683HIGHCisco Firepower Management Center SQL Injection VulnerabilitiesEPSS 3.0%CVE-2019-12680HIGHCisco Firepower Management Center SQL Injection VulnerabilitiesEPSS 3.0%CVE-2019-12679HIGHCisco Firepower Management Center SQL Injection VulnerabilitiesEPSS 3.0%CVE-2019-12682HIGHCisco Firepower Management Center SQL Injection VulnerabilitiesEPSS 3.0%CVE-2019-12681HIGHCisco Firepower Management Center SQL Injection VulnerabilitiesEPSS 3.0%CVE-2019-12684HIGHCisco Firepower Management Center SQL Injection VulnerabilitiesEPSS 3.0%CVE-2025-1323HIGHWP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Unauthenticated SQL InjectionEPSS 2.9%CVE-2020-25638HIGHA flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA CriteriEPSS 2.9%CVE-2020-13499CRITICALAn SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. SEPSS 2.9%CVE-2020-13501CRITICALAn SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. SEPSS 2.9%CVE-2020-13500CRITICALSQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. SpecEPSS 2.9%CVE-2022-34871HIGHThis vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploEPSS 2.9%CVE-2024-8911CRITICALLatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL InjectionEPSS 2.9%CVE-2022-27479—SQL injection vulnerability in chart data APIEPSS 2.9%CVE-2022-42426HIGHThis vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploEPSS 2.9%CVE-2022-42428HIGHThis vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploEPSS 2.9%CVE-2021-35234HIGHExposed Dangerous Functions - Privileged EscalationEPSS 2.9%CVE-2021-24385—Filebird 4.7.3 - Unauthenticated SQL InjectionEPSS 2.8%CVE-2022-2272CRITICALThis vulnerability allows remote attackers to bypass authentication on affected installations of Sante PACS Server 3.0.4. Authentication is EPSS 2.8%CVE-2023-6575MEDIUMByzoro S210 HTTP POST Request repair.php sql injectionEPSS 2.8%