Falhas do tipo CWE-89

13.302 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2026-32551CRITICALWordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-28001CRITICALWordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-49067CRITICALWordPress Advanced 301 and 302 Redirect plugin <= 1.6.9 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-61950CRITICALWordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-57683CRITICALWordPress WP Fast Total Search plugin <= 1.80.280 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-54849CRITICALWordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.11 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-73391CRITICALWordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-42665CRITICALWordPress WP Data Access plugin <= 5.5.70 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-32554CRITICALWordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerabilityEPSS 0.4%CVE-2024-34992HIGHSQL Injection vulnerability in the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules fEPSS 0.4%CVE-2026-66593CRITICALWordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-48886CRITICALWordPress JS Help Desk plugin <= 3.0.9 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-42672CRITICALWordPress WP Directory Kit plugin <= 1.5.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2025-7482MEDIUMPHPGurukul Vehicle Parking Management System print.php sql injectionEPSS 0.4%CVE-2023-42807MEDIUMFrappe LMS SQL Injection Issue on People PageEPSS 0.4%CVE-2024-13844MEDIUMPost SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns ParameterEPSS 0.4%CVE-2026-39229MEDIUMBolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages. An authenticated attacker with low-level EPSS 0.4%CVE-2026-2508MEDIUMGravity Forms Booking <= 2.7.1 - Authenticated (Subscriber+) Time-Based SQL Injection via 'staff_id'EPSS 0.4%CVE-2026-10105HIGHagno 2.6.5 SQL Injection via ClickHouse delete_by_metadata()EPSS 0.4%CVE-2025-69216HIGHOpenSTAManager has an SQL Injection in Scadenzario Print TemplateEPSS 0.4%