Falhas do tipo CWE-89

13.374 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2025-69308CRITICALWordPress Nestbyte Core plugin <= 1.2 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-4665CRITICALWordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability thatEPSS 0.3%CVE-2025-12277MEDIUMAbdullah-Hasan-Sajjad Online-School studentLogin.php sql injectionEPSS 0.3%CVE-2025-13395MEDIUMcodehub666 94list function.php login sql injectionEPSS 0.3%CVE-2026-105387MEDIUMgirishsaraf Online-Appointment-Booking-System Patient Login cover.php mysqli_query sql injectionEPSS 0.3%CVE-2025-65091CRITICALXWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONServiceEPSS 0.3%CVE-2025-10115MEDIUMSiempreCMS user_search_ajax.php sql injectionEPSS 0.3%CVE-2026-11531MEDIUMimvks786 student_management_system Administrator Login Endpoint admin_login.php sql injectionEPSS 0.3%CVE-2026-103232MEDIUMAdithyaYelloju Restaurant-Management-System table_booking.php mysqli_query sql injectionEPSS 0.3%CVE-2025-50984MEDIUMdiskover-web v2.3.0 Community Edition is vulnerable to multiple boolean-based blind SQL injection flaws in its Elasticsearch configuration fEPSS 0.3%CVE-2025-7638MEDIUMForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` ParameterEPSS 0.3%CVE-2025-60269CRITICALJEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the src/main/java/org/jeecgframework/web/cgreport/controEPSS 0.3%CVE-2024-46078HIGHitsourcecode Sports Management System Project 1.0 is vulnerable to SQL Injection in the function delete_category of the file sports_scheduliEPSS 0.3%CVE-2026-11530MEDIUMimvks786 student_management_system Login index.ph sql injectionEPSS 0.3%CVE-2026-105776MEDIUMbhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL admin_transaction.php sql injectionEPSS 0.3%CVE-2025-10037MEDIUMFeatured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL InjectionEPSS 0.3%CVE-2025-3571MEDIUMFannuo Enterprise Content Management System 凡诺企业网站管理系统 cms_chip.php sql injectionEPSS 0.3%CVE-2025-12248MEDIUMCLTPHP search.html sql injectionEPSS 0.3%CVE-2026-10877MEDIUMSourceCodester Ship Ferry Ticket Reservation System Admin Login login.php sql injectionEPSS 0.3%CVE-2025-10036MEDIUMFeatured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL InjectionEPSS 0.3%