Falhas do tipo CWE-89

13.618 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2016-10550—sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server iEPSS 1.9%CVE-2023-0961MEDIUMSourceCodester Music Gallery Site GET Request view_music_details.php sql injectionEPSS 1.9%CVE-2026-41640HIGHNocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager LoadingEPSS 1.9%CVE-2021-43863HIGHSQL Injection in FileContentProvider (GHSL-2021-1007)EPSS 1.9%CVE-2019-1825HIGHCisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection VulnerabilitiesEPSS 1.9%CVE-2019-1824HIGHCisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection VulnerabilitiesEPSS 1.9%CVE-2026-3326HIGHXStore < 9.7.3 - Unauthenticated SQLiEPSS 1.9%CVE-2021-36916HIGHWordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerabilityEPSS 1.9%CVE-2021-41147HIGHSQL injection in the planning edition panelEPSS 1.9%CVE-2024-3217HIGHWP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL InjectionEPSS 1.9%CVE-2022-0694—Advanced Booking Calendar < 1.7.0 - Unauthenticated SQL InjectionEPSS 1.8%CVE-2024-6813HIGHNETGEAR ProSAFE Network Management System getSortString SQL Injection Remote Code Execution VulnerabilityEPSS 1.8%CVE-2023-39357HIGHA Defect in sql_save() Causes Multiple SQL Injection Vulnerabilities in CactiEPSS 1.8%CVE-2020-6009—LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.EPSS 1.8%CVE-2025-22953CRITICALA SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.57EPSS 1.8%CVE-2026-41641HIGHNocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` CallEPSS 1.8%CVE-2021-24361—GeoDirectory Location Manager < 2.1.0.10 - Multiple Unauthenticated SQL InjectionsEPSS 1.8%CVE-2020-36195CRITICALSQL Injection Vulnerability in Multimedia Console and the Media Streaming Add-OnEPSS 1.8%CVE-2025-41403HIGHSQL InjectionEPSS 1.8%CVE-2026-42031HIGHCKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`EPSS 1.8%