Falhas do tipo CWE-89

13.302 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2026-39512CRITICALWordPress GeoDirectory plugin <= 2.8.152 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-59533CRITICALWordPress Relevanssi Light plugin <= 1.2.2 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-54812CRITICALWordPress Motors plugin <= 1.4.109 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-59527CRITICALWordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-54825CRITICALWordPress wpDataTables plugin <= 7.4 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-66446CRITICALWordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-66680CRITICALWordPress Locatoraid Store Locator plugin <= 3.9.72 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-59514CRITICALWordPress Buddyboss Platform plugin <= 3.0.5 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-39530CRITICALWordPress SpeakOut! Email Petitions plugin <= 4.6.5 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-39494CRITICALWordPress Product Filter by WBW plugin <= 3.1.2 - SQL Injection vulnerabilityEPSS 0.4%CVE-2025-22799HIGHWordPress Neon Product Designer Plugin <= 2.2.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-49076CRITICALWordPress JetEngine plugin <= 3.8.9.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-61966CRITICALWordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2023-4608MEDIUMAn authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command.  This afEPSS 0.4%CVE-2026-57679CRITICALWordPress GeekyBot plugin <= 1.2.5 - SQL Injection vulnerabilityEPSS 0.4%CVE-2025-20620HIGHSQL Injection vulnerability exists in STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected product may EPSS 0.4%CVE-2026-73185CRITICALWordPress NGG Smart Image Search plugin < 4.0.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-54843CRITICALWordPress MDTF plugin <= 1.3.7 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-73187CRITICALWordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-42684CRITICALWordPress WP Job Portal plugin <= 2.5.1 - SQL Injection vulnerabilityEPSS 0.4%