Falhas do tipo CWE-89

13.130 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2024-53783HIGHWordPress Ni WooCommerce Cost Of Goods plugin <= 3.2.8 - SQL Injection vulnerabilityEPSS 0.5%CVE-2023-28849CRITICALGLPI vulnerable to SQL injection and Stored XSS via inventory agent requestEPSS 0.5%CVE-2026-0501CRITICALSQL Injection Vulnerability in SAP S/4HANA Private Cloud and On-Premise (Financials � General Ledger)EPSS 0.5%CVE-2025-4930MEDIUMCampcodes Online Shopping Portal my-cart.php sql injectionEPSS 0.5%CVE-2025-4761MEDIUMPHPGurukul Complaint Management System admin-profile.php sql injectionEPSS 0.5%CVE-2025-9413MEDIUMlostvip-com ruoyi-go system_router.go SelectListByPage sql injectionEPSS 0.5%CVE-2025-25206HIGHIncorrect input validation could allow an authenticated user to read sensitive informationEPSS 0.5%CVE-2026-1105MEDIUMEasyCMS UserAction.class.php sql injectionEPSS 0.5%CVE-2024-50479CRITICALWordPress Woocommerce Quote Calculator plugin <= 1.1 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-5403MEDIUMchaitak-gorai Blogbook GET Parameter view_all_posts.php sql injectionEPSS 0.5%CVE-2024-34989CRITICALIn the module RSI PDF/HTML catalog evolution (prestapdf) <= 7.0.0 from RSI for PrestaShop, a guest can perform SQL injection via `PrestaPDFPEPSS 0.5%CVE-2024-56041HIGHWordPress VibeBP plugin < 1.9.9.5.1 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-24375HIGHSQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter.EPSS 0.5%CVE-2025-6480MEDIUMcode-projects Simple Pizza Ordering System addcatexec.php sql injectionEPSS 0.5%CVE-2026-18782CRITICALSQL Injection in Trex Digital Manufacturing's Trex MESEPSS 0.5%CVE-2025-0231MEDIUMCodezips Gym Management System submit_payments.php sql injectionEPSS 0.5%CVE-2024-5098MEDIUMSourceCodester Simple Inventory System login.php sql injectionEPSS 0.5%CVE-2024-7934MEDIUMitsourcecode Project Expense Monitoring System execute.php sql injectionEPSS 0.5%CVE-2024-5325HIGHForm Vibes <= 1.4.10 - Authenticated (Subscriber+) SQL Injection via fv_export_dataEPSS 0.5%CVE-2025-0334MEDIUMleiyuxi cy-fast listData sql injectionEPSS 0.5%