Falhas do tipo CWE-89

12.845 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2021-24341—Xllentech English Islamic Calendar < 2.6.8 - Authenticated SQL InjectionEPSS 1.6%CVE-2026-8054CRITICALUnauthenticated SQL Injection in dotCMS Publish Audit APIEPSS 1.6%CVE-2020-26075MEDIUMCisco IoT Field Network REST API Insufficient Input Validation VulnerabilityEPSS 1.6%CVE-2022-1014—WP Contacts Manager <= 2.2.4 - Unauthenticated SQLiEPSS 1.6%CVE-2026-11840HIGHSQL InjectionEPSS 1.6%CVE-2021-22854HIGHSoar Cloud System Co., Ltd. HR Portal - SQL InjectionEPSS 1.6%CVE-2021-24553—Timeline Calendar <= 1.2 - Authenticated (admin+) SQL InjectionEPSS 1.6%CVE-2021-24550—Broken Link Manager <= 0.6.5 - Authenticated (admin+) SQL InjectionEPSS 1.6%CVE-2021-24552—Simple Events Calendar <= 1.4.0 - Authenticated (admin+) SQL InjectionEPSS 1.6%CVE-2023-50395HIGHSQL Injection Remote Code Execution VulnerabilityEPSS 1.6%CVE-2026-6854HIGHMy Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' ParametersEPSS 1.6%CVE-2020-13566HIGHSQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an EPSS 1.6%CVE-2021-24866—WP Data Access < 5.0.0 - Admin+ SQL InjectionEPSS 1.6%CVE-2021-24863—StopBadBots < 6.67 - Unauthenticated SQL InjectionEPSS 1.6%CVE-2021-24951—LearnPress < 4.1.4 - Admin+ SQL InjectionEPSS 1.6%CVE-2024-50672CRITICALA NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to reset user and administEPSS 1.6%CVE-2021-24337—Video Embed <= 1.0 - Authenticated (subscriber+) SQL InjectionEPSS 1.6%CVE-2021-24391—Cashtomer <= 1.0.0 - Authenticated SQL InjectionEPSS 1.6%CVE-2021-24520—Stock in & out <= 1.0.4 - Authenticated SQL InjectionEPSS 1.6%CVE-2021-24631—Unlimited PopUps <= 4.5.3 - Author+ SQL InjectionEPSS 1.6%