Falhas do tipo CWE-89

12.845 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2026-18912HIGHManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticateEPSS 1.5%CVE-2021-24747—SEO Booster < 3.8 - Admin+ SQL InjectionEPSS 1.5%CVE-2021-24753—Rich Reviews by Starfish < 1.9.6 - Admin+ SQL InjectionEPSS 1.5%CVE-2019-12710MEDIUMCisco Unified Communications Manager SQL Injection VulnerabilityEPSS 1.5%CVE-2024-23539HIGHApache Fineract: Under certain system configurations, the sqlSearch parameter for specific endpoints was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.EPSS 1.5%CVE-2022-2718HIGHJoomSport – for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authenticated (Admin+) SQL Injection via orderbyEPSS 1.5%CVE-2026-69085CRITICALSiYuan before v3.7.3 SQL Injection via searchDocsEPSS 1.5%CVE-2022-2717HIGHJoomSport – for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authentciated (Admin+) SQL Injection via orderbyEPSS 1.5%CVE-2021-25069—WordPress Download Manager < 3.2.34 - Authenticated SQL Injection to Reflected XSSEPSS 1.5%CVE-2021-26636HIGHMaxboard Remote Code ExecutionEPSS 1.5%CVE-2022-1006—Advanced Booking Calendar < 1.7.1 - Admin+ SQLiEPSS 1.5%CVE-2022-0420—RegistrationMagic < 5.0.2.2 - Admin+ SQL InjectionEPSS 1.5%CVE-2022-1023—Podcast Importer SecondLine < 1.3.8 - Admin+ SQLiEPSS 1.5%CVE-2026-28516CRITICALopenDCIM <= 23.04 SQL Injection in Config::UpdateParameterEPSS 1.5%CVE-2024-43918CRITICALWordPress WBW Product Table PRO plugin <= 1.9.4 - Unauthenticated Arbitrary SQL Query Execution vulnerabilityEPSS 1.5%CVE-2023-5412HIGHImage horizontal reel scroll slideshow <= 13.2 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 1.5%CVE-2022-31058HIGHSQL injection via the field name of a tracker in TuleapEPSS 1.5%CVE-2018-0404—Cisco RV180W Wireless-N Multifunction VPN Router SQL Injection VulnerabilityEPSS 1.5%CVE-2021-22856CRITICALChanGate EnterPrise Co., Ltd property management system - SQL InjectionEPSS 1.5%CVE-2022-0383—WP Review Slider < 11.0 - Admin+ SQL InjectionEPSS 1.5%