Falhas do tipo CWE-89

11.873 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2025-11910MEDIUMShenzhen Ruiming Technology Streamax Crocus MemoryState.do query sql injectionEPSS 0.5%CVE-2024-7278MEDIUMitsourcecode Alton Management System team_save.php sql injectionEPSS 0.5%CVE-2025-44034HIGHSQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the alph parameters in src/main/EPSS 0.5%CVE-2019-25543HIGHNetartmedia Real Estate Portal 5.0 SQL Injection via index.phpEPSS 0.5%CVE-2025-26186HIGHSQL Injection vulnerability in openSIS v.9.1 allows a remote attacker to execute arbitrary code via the id parameter in Ajax.phpEPSS 0.5%CVE-2025-27617MEDIUMPimcore Vulnerable to SQL Injection in getRelationFilterConditionEPSS 0.5%CVE-2024-11714MEDIUMWP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via getFieldsForVisibleCombobox()EPSS 0.5%CVE-2019-25542HIGHNetartmedia Real Estate Portal 5.0 SQL Injection via index.phpEPSS 0.5%CVE-2024-11713MEDIUMWP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via wpjobportal_deactivate()EPSS 0.5%CVE-2025-4060MEDIUMPHPGurukul Notice Board System category.php sql injectionEPSS 0.5%CVE-2025-40735HIGHA vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected devices are vulnerable to SQL injection. This could allEPSS 0.5%CVE-2026-28805HIGHOpenSTAManager: Time-Based Blind SQL Injection via `options[stato]` ParameterEPSS 0.5%CVE-2024-11710MEDIUMWP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL InjectionEPSS 0.5%CVE-2024-53807HIGHWordPress WP Mailster plugin <= 1.8.16.0 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-12067MEDIUMWP Travel – Ultimate Travel Booking System, Tour Management Engine <= 10.0.0 - Authenticated (Subscriber+) SQL InjectionEPSS 0.5%CVE-2025-56162MEDIUMYOSHOP 2.0 suffers from an unauthenticated SQL injection in the goodsIds parameter of the /api/goods/listByIds endpoint. The getListByIds fuEPSS 0.5%CVE-2024-47325HIGHWordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.7 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-13475HIGHSmall Package Quotes – UPS Edition <= 4.5.16 - Unauthenticated SQL InjectionEPSS 0.5%CVE-2024-2386HIGHWordPress Plugin for Google Maps – WP MAPS <= 4.6.1 - Authenticated (Contributor+) SQL InjectionEPSS 0.5%CVE-2026-34099CRITICALGuardian Language-System Unauthenticated SQL Injection via id Parameter in job_info.phpEPSS 0.5%