Falhas do tipo CWE-89

13.150 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2025-52474HIGHWeGIA SQL Injection Vulnerability in id Parameter on control.php EndpointEPSS 0.5%CVE-2025-25222HIGHThe LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retrEPSS 0.5%CVE-2024-6041MEDIUMitsourcecode Gym Management System manage_user.php sql injectionEPSS 0.5%CVE-2025-1841MEDIUMESAFENET CDG ClientSortLog.jsp sql injectionEPSS 0.5%CVE-2025-7186MEDIUMcode-projects Chat System fetch_chat.php sql injectionEPSS 0.5%CVE-2026-40822MEDIUMAuthenticated SQLi in DevSerialReset functionEPSS 0.5%CVE-2026-2397CRITICALSQLi in AdamPOS' MobilMen 20TEPSS 0.5%CVE-2026-40826MEDIUMAuthenticated SQLi in dsgvo_contracts viewEPSS 0.5%CVE-2022-39069MEDIUMThere is a SQL injection vulnerability in ZTE ZAIP-AIE. Due to lack of input verification by the server, an attacker could trigger an attackEPSS 0.5%CVE-2015-20122HIGHSeeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jspEPSS 0.5%CVE-2026-2236HIGHHGiga｜C&Cm@il - SQL InjectionEPSS 0.5%CVE-2026-76428MEDIUMCisco ISE Profiler SQL Injection VulnerabilityEPSS 0.5%CVE-2025-25221HIGHThe LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.EPSS 0.5%CVE-2026-76426MEDIUMCisco ISE REST API SQL Injection VulnerabilityEPSS 0.5%CVE-2026-40821MEDIUMAuthenticated SQLi in getAccountByID functionEPSS 0.5%CVE-2025-53527HIGHWeGIA allows Time-Based Blind SQL Injection in the relatorio_geracao.php endpointEPSS 0.5%CVE-2025-25876HIGHA vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /delete.php. The attEPSS 0.5%CVE-2026-48528CRITICALMetacat has an unauthenticated SQL injection vulnerabilityEPSS 0.5%CVE-2025-10563MEDIUMCampcodes Grocery Sales and Inventory System ajax.php sql injectionEPSS 0.5%CVE-2025-1464MEDIUMBaiyi Cloud Asset Management System admin.house.collect.php sql injectionEPSS 0.5%