Falhas do tipo CWE-89

13.618 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2025-8324CRITICALSQL InjectionEPSS 1.8%CVE-2023-32590CRITICALWordPress Subscribe to Category Plugin <= 2.7.4 is vulnerable to SQL InjectionEPSS 1.8%CVE-2020-6125MEDIUMAn exploitable SQL injection vulnerability exists in the GetSchool.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request EPSS 1.8%CVE-2020-6136MEDIUMAn exploitable SQL injection vulnerability exists in the DownloadWindow.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP reqEPSS 1.8%CVE-2026-79947MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliEPSS 1.8%CVE-2020-6135MEDIUMAn exploitable SQL injection vulnerability exists in the Validator.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request EPSS 1.8%CVE-2020-6145MEDIUMAn SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request cEPSS 1.8%CVE-2021-38324HIGHSP Rental Manager <= 1.5.3 Unauthenticated SQL InjectionEPSS 1.8%CVE-2024-31460MEDIUMCacti SQL Injection vulnerability in lib/api_automation.php caused by reading dirty data stored in databaseEPSS 1.8%CVE-2019-5476—An SQL Injection in the Nextcloud Lookup-Server < v0.3.0 (running on https://lookup.nextcloud.com) caused unauthenticated users to be able tEPSS 1.8%CVE-2023-0938MEDIUMSourceCodester Music Gallery Site GET Request music_list.php sql injectionEPSS 1.8%CVE-2022-0836—SEMA API < 4.02 - Unauthenticated SQLiEPSS 1.8%CVE-2024-13322HIGHAds Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.88 - Unauthenticated SQL InjectionEPSS 1.8%CVE-2025-62390MEDIUMSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataEPSS 1.8%CVE-2024-50328HIGHSQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticEPSS 1.8%CVE-2025-62389MEDIUMSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataEPSS 1.8%CVE-2024-39842HIGHA SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via user massiveEPSS 1.8%CVE-2025-62387MEDIUMSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataEPSS 1.8%CVE-2021-26609HIGHWordPress Mangboard SQL-Injection vulnerabilityEPSS 1.8%CVE-2024-54761MEDIUMBigAnt Office Messenger 5.6.06 is vulnerable to SQL Injection via the 'dev_code' parameter.EPSS 1.8%