Falhas do tipo CWE-89

13.368 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2025-11981MEDIUMSchool Management System – WPSchoolPress <= 2.2.23 - Authenticated (Administrator+) SQL InjectionEPSS 0.3%CVE-2026-96267HIGHWP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' ParameterEPSS 0.3%CVE-2023-42235LOWAn issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiEPSS 0.3%CVE-2025-11972MEDIUMTag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.0 - Authenticated (Editor+) SQL InjectionEPSS 0.3%CVE-2026-92766HIGHVitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' ParameterEPSS 0.3%CVE-2025-11980MEDIUMQuick Featured Images <= 13.7.3 - Authenticated (Editor+) SQL Injection via delete_orphanedEPSS 0.3%CVE-2026-17543HIGHSQL injection in ext-pgsql via E'...' backslash breakoutEPSS 0.3%CVE-2026-18561HIGHUnlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL InjectionEPSS 0.3%CVE-2026-2412MEDIUMQuiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' ParameterEPSS 0.3%CVE-2023-42238LOWAn issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiEPSS 0.3%CVE-2023-42236LOWAn issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GETEPSS 0.3%CVE-2026-57588LOWSQL Injection in Nessus via Malicious Scan Result File ImportEPSS 0.3%CVE-2025-52618MEDIUMHCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerabilityEPSS 0.3%CVE-2026-4593MEDIUMerupts erupt MCP Tool EruptDataQuery.java EruptDataQuery sql injectionEPSS 0.3%CVE-2026-4234MEDIUMSSCMS DDL SitesAddController.Submit.cs sql injectionEPSS 0.3%CVE-2026-4573MEDIUMSourceCodester Simple E-learning System HTTP GET Parameter delete_post.php sql injectionEPSS 0.3%CVE-2025-69310CRITICALWordPress Woodly Core plugin <= 1.4 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-3672MEDIUMJeecgBoot getDictItems isExistSqlInjectKeyword sql injectionEPSS 0.3%CVE-2025-69365CRITICALWordPress Uroan Core plugin <= 1.4.4 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-4230MEDIUMvanna-ai vanna Endpoint __init__.py update_sql sql injectionEPSS 0.3%