Falhas do tipo CWE-89

12.845 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2021-24403—WordPress Page Contact <= 1.0 - Authenticated (editor+) SQL InjectionEPSS 1.5%CVE-2021-24625—SpiderCatalog <= 1.7.3 - Admin+ SQL InjectionEPSS 1.5%CVE-2021-24398—Responsive 3D Slider <= 1.2 - Authenticated SQL InjectionEPSS 1.5%CVE-2020-11004HIGHSQL Injection in AdmidioEPSS 1.5%CVE-2025-5569MEDIUMIdeaCMS getList.html Goods sql injectionEPSS 1.5%CVE-2025-54726CRITICALWordPress JS Archive List Plugin < 6.1.6 - SQL Injection VulnerabilityEPSS 1.5%CVE-2023-39344CRITICALsocial-media-skeleton vulnerable to Pre-Auth SQLi leading to RCEEPSS 1.5%CVE-2026-28501CRITICALWWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.phpEPSS 1.5%CVE-2020-13591MEDIUMAn exploitable SQL injection vulnerability exists in the "access_rules/rules_form" page of the Rukovoditel Project Management App 2.7.2. A sEPSS 1.5%CVE-2020-13592MEDIUMAn exploitable SQL injection vulnerability exists in "global_lists/choices" page of the Rukovoditel Project Management App 2.7.2. A speciallEPSS 1.5%CVE-2020-13587MEDIUMAn exploitable SQL injection vulnerability exists in the "forms_fields_rules/rules" page of the Rukovoditel Project Management App 2.7.2. A EPSS 1.5%CVE-2021-24149—Modern Events Calendar Lite < 5.16.6 - Authenticated SQL InjectionEPSS 1.5%CVE-2021-24137—Blog2Social: Social Media Auto Post & Scheduler < 6.3.1 - Authenticated SQL InjectionEPSS 1.5%CVE-2024-42005CRITICALAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONFEPSS 1.5%CVE-2022-31890CRITICALSQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae viaEPSS 1.5%CVE-2021-25045—Asgaros Forum < 1.15.15 - Admin+ SQL Injection via forum_idEPSS 1.5%CVE-2021-24865—Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL InjectionEPSS 1.5%CVE-2026-18912HIGHManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticateEPSS 1.5%CVE-2021-24753—Rich Reviews by Starfish < 1.9.6 - Admin+ SQL InjectionEPSS 1.5%CVE-2021-24747—SEO Booster < 3.8 - Admin+ SQL InjectionEPSS 1.5%