Falhas do tipo CWE-89

13.302 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2026-42740CRITICALWordPress Tainacan plugin <= 1.0.3 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-78260CRITICALWordPress Epayco plugin <= 8.4.6 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-42386CRITICALWordPress Order Delivery Date for WooCommerce plugin <= 4.5.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-57726CRITICALWordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-48875CRITICALWordPress JetSmartFilters plugin <= 3.8.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-52693CRITICALWordPress eCommerce Product Catalog plugin <= 3.5.5 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-61966CRITICALWordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-54843CRITICALWordPress MDTF plugin <= 1.3.7 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-81756CRITICALWordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-42381CRITICALWordPress Funnel Builder by FunnelKit plugin <= 3.15.0.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-66436CRITICALWordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-54187CRITICALWordPress JetEngine plugin <= 3.8.10.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-42747CRITICALWordPress Easy Form Builder plugin <= 4.0.6 - SQL Injection vulnerabilityEPSS 0.4%CVE-2023-4608MEDIUMAn authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command.  This afEPSS 0.4%CVE-2026-39492CRITICALWordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-40797CRITICALWordPress WebinarIgnition plugin <= 4.08.253 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-39441CRITICALWordPress Feed KuantoKusta for WooCommerce – Free plugin <= 5.3 - SQL Injection vulnerabilityEPSS 0.4%CVE-2025-3767HIGHSQL Injection in Centreon BAM boolean KPI listingEPSS 0.4%CVE-2026-57679CRITICALWordPress GeekyBot plugin <= 1.2.5 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-59515CRITICALWordPress AIWU plugin <= 1.5.4 - SQL Injection vulnerabilityEPSS 0.4%