Falhas do tipo CWE-89

12.837 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2025-6095MEDIUMcodesiddhant Jasmin Ransomware checklogin.php sql injectionEPSS 2.7%CVE-2025-4396HIGHRelevanssi <= 4.24.4 (Free) and <= 2.27.5 (Premium) - Unauthenticated SQL InjectionEPSS 2.7%CVE-2022-27596CRITICALVulnerability in QTSEPSS 2.7%CVE-2024-0705CRITICALStripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL InjectionEPSS 2.6%CVE-2020-6139CRITICALSQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The username_stf_email parameter in the passworEPSS 2.6%CVE-2020-6140CRITICALSQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email parameter in the passworEPSS 2.6%CVE-2020-6138CRITICALSQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The uname parameter in the password reset page EPSS 2.6%CVE-2020-6137CRITICALSQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email parameter in the passworEPSS 2.6%CVE-2019-9885CRITICALeClass platform contains a SQL injection vulnerabilityEPSS 2.6%CVE-2020-29493CRITICALDELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain a SQL Injection Vulnerability in Fitness Analyzer. A remote unauthenticated attacEPSS 2.6%CVE-2024-5057CRITICALWordPress Easy Digital Downloads plugin <= 3.2.12 - SQL Injection vulnerabilityEPSS 2.6%CVE-2021-24132—Slider by 10Web < 1.2.36 - Multiple Authenticated SQL InjectionEPSS 2.6%CVE-2022-44727CRITICALThe EU Cookie Law GDPR (Banner + Blocker) module before 2.1.3 for PrestaShop allows SQL Injection via a cookie ( lgcookieslaw or __lglaw ).EPSS 2.6%CVE-2024-44541CRITICALevilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action=processlogin."EPSS 2.6%CVE-2024-12025HIGHCollapsing Categories <= 3.0.8 - Unauthenticated SQL InjectionEPSS 2.6%CVE-2023-24000HIGHWordPress GamiPress Plugin <= 2.5.7 is vulnerable to SQL InjectionEPSS 2.6%CVE-2024-5678MEDIUMSQL InjectionEPSS 2.5%CVE-2024-5608HIGHSQL InjectionEPSS 2.5%CVE-2014-2351—CSWorks SQL InjectionEPSS 2.5%CVE-2019-10141HIGHA vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulneraEPSS 2.5%