Falhas do tipo CWE-89

13.122 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2025-8503MEDIUMcode-projects Online Medicine Guide adaddmed.php sql injectionEPSS 0.5%CVE-2023-3679MEDIUMSourceCodester Lost and Found Information System HTTP POST Request sql injectionEPSS 0.5%CVE-2026-35470HIGHOpenSTAManager has a SQL Injection via righe Parameter in confronta_righe ModalsEPSS 0.5%CVE-2019-25756HIGHJoomla! Component vAccount 2.0.2 SQL Injection via vaccount-dashboardEPSS 0.5%CVE-2025-56162MEDIUMYOSHOP 2.0 suffers from an unauthenticated SQL injection in the goodsIds parameter of the /api/goods/listByIds endpoint. The getListByIds fuEPSS 0.5%CVE-2024-44839CRITICALRapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the articleid parameter at /default/article.php.EPSS 0.5%CVE-2019-25755HIGHJoomla vReview 1.9.11 SQL Injection via editReviewEPSS 0.5%CVE-2017-20253HIGHJoomla! Component My Projects 2.0 SQL InjectionEPSS 0.5%CVE-2025-8498MEDIUMcode-projects Online Medicine Guide index.php sql injectionEPSS 0.5%CVE-2017-20269HIGHJoomla! Component KissGallery 1.0.0 SQL InjectionEPSS 0.5%CVE-2017-20267HIGHJoomla! Component Calendar Planner 1.0.1 SQL InjectionEPSS 0.5%CVE-2017-20261HIGHJoomla! Component Bargain Product VM3 1.0 SQL InjectionEPSS 0.5%CVE-2025-8496MEDIUMprojectworlds Online Admission System viewform.php sql injectionEPSS 0.5%CVE-2019-25754HIGHJoomla vRestaurant 1.9.4 SQL Injection via menu-listing-layoutEPSS 0.5%CVE-2023-3528MEDIUMThinuTech ThinuCMS category.php sql injectionEPSS 0.5%CVE-2025-5708MEDIUMcode-projects Real Estate Property Management System NewsReport.php sql injectionEPSS 0.5%CVE-2023-3644MEDIUMSourceCodester Service Provider Management System sql injectionEPSS 0.5%CVE-2024-45771CRITICALRapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the password parameter at /resource/runlogin.php.EPSS 0.5%CVE-2026-15993MEDIUMForm Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE ClauseEPSS 0.5%CVE-2026-33082HIGHDataEase: SQL Injection in v2 Dataset ExportEPSS 0.5%