Falhas do tipo CWE-89

11.873 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2025-4728MEDIUMSourceCodester Best Online News Portal search.php sql injectionEPSS 0.5%CVE-2025-25226CRITICAL[20250401] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database packageEPSS 0.5%CVE-2024-13369MEDIUMTour Master - Tour Booking, Travel, Hotel <= 5.3.7 - Authenticated (Subscriber+) SQL Injection via review_id ParameterEPSS 0.5%CVE-2025-4193MEDIUMitsourcecode Restaurant Management System category_update.php sql injectionEPSS 0.5%CVE-2024-43776HIGHHuachu Easytest Online Learning Test Platform - SQL InjectionEPSS 0.5%CVE-2025-4734MEDIUMCampcodes Sales and Inventory System ci_update.php sql injectionEPSS 0.5%CVE-2025-32389HIGHNamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports PagesEPSS 0.5%CVE-2024-43775HIGHHuachu Easytest Online Learning Test Platform - SQL InjectionEPSS 0.5%CVE-2025-4195MEDIUMitsourcecode Gym Management System ajax.php sql injectionEPSS 0.5%CVE-2025-4192MEDIUMitsourcecode Restaurant Management System category_save.php sql injectionEPSS 0.5%CVE-2024-43774HIGHHuachu Easytest Online Learning Test Platform - SQL InjectionEPSS 0.5%CVE-2018-25185HIGHWecodex Restaurant CMS 1.0 SQL Injection via LoginEPSS 0.5%CVE-2023-39423HIGHImproper Neutralization of Special Elements used in an SQL Command in RDPData.dllEPSS 0.5%CVE-2025-54119CRITICALADOdb's sqlite3 driver allows SQL injectionEPSS 0.5%CVE-2026-2058MEDIUMmathurvishal CloudClassroom-PHP-Project Post Query Details postquerypublic.php sql injectionEPSS 0.5%CVE-2026-27179HIGHMajorDoMo Unauthenticated SQL Injection in Commands ModuleEPSS 0.5%CVE-2025-7177MEDIUMPHPGurukul Car Washing Management System editcar-washpoint.php sql injectionEPSS 0.5%CVE-2021-4450HIGHPost Grid <= 2.1.12 - Contributor+ SQL InjectionEPSS 0.5%CVE-2023-5293MEDIUMECshop leancloud.php sql injectionEPSS 0.5%CVE-2025-26943CRITICALWordPress Easy Quotes plugin <= 1.2.2 - SQL Injection vulnerabilityEPSS 0.5%