Falhas do tipo CWE-89

13.370 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2026-42474MEDIUMSQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted `data` array to the data function in BuildHelper.php.EPSS 0.3%CVE-2026-3672MEDIUMJeecgBoot getDictItems isExistSqlInjectKeyword sql injectionEPSS 0.3%CVE-2026-4513MEDIUMvanna-ai vanna base.py ask sql injectionEPSS 0.3%CVE-2026-105469MEDIUMgirishsaraf Online-Appointment-Booking-System AJAX Endpoint get_town.php sql injectionEPSS 0.3%CVE-2025-69307CRITICALWordPress Medinik Core plugin <= 1.3.6 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-69365CRITICALWordPress Uroan Core plugin <= 1.4.4 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-4597MEDIUM648540858 wvp-GB28181-pro Stream Proxy Query StreamProxyProvider.java selectAll sql injectionEPSS 0.3%CVE-2026-4173MEDIUMCodePhiliaX Chat2DB Database Export DMDBManage.java updateProcedure sql injectionEPSS 0.3%CVE-2026-4241MEDIUMitsourcecode College Management System time-table.php sql injectionEPSS 0.3%CVE-2026-4230MEDIUMvanna-ai vanna Endpoint __init__.py update_sql sql injectionEPSS 0.3%CVE-2025-50127HIGHExtension - dj-extensions.com - SQLi vulnerability in DJ-Flyer component 1.0-3.2 for JoomlaEPSS 0.3%CVE-2026-4573MEDIUMSourceCodester Simple E-learning System HTTP GET Parameter delete_post.php sql injectionEPSS 0.3%CVE-2026-4507MEDIUMMindinventory MindSQL mindsql_core.py ask_db sql injectionEPSS 0.3%CVE-2025-60118HIGHWordPress PGS Core Plugin <= 5.9.0 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-49402HIGHWordPress Exertio Framework Plugin <= 1.3.3 - SQL Injection VulnerabilityEPSS 0.3%CVE-2024-33121MEDIUMRoothub v2.6 was discovered to contain a SQL injection vulnerability via the 's' parameter in the search() function.EPSS 0.3%CVE-2025-69337CRITICALWordPress Wolmart Core plugin <= 1.9.6 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-4234MEDIUMSSCMS DDL SitesAddController.Submit.cs sql injectionEPSS 0.3%CVE-2025-69306CRITICALWordPress Electio Core plugin <= 1.4 - SQL Injection vulnerabilityEPSS 0.3%CVE-2024-28521HIGHSQL Injection vulnerability in Netcome NS-ASG Application Security Gateway v.6.3.1 allows a local attacker to execute arbitrary code and obtEPSS 0.3%