Falhas do tipo CWE-89

12.846 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2022-1472—Better Find and Replace < 1.3.6 - Admin+ SQLiEPSS 1.3%CVE-2021-24143—AccessPress Social Icons < 1.8.1 - Authenticated SQL InjectionEPSS 1.3%CVE-2025-22461HIGHSQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admiEPSS 1.3%CVE-2021-24185—Tutor LMS < 1.7.7 - SQL Injection via tutor_place_ratingEPSS 1.3%CVE-2021-24186—Tutor LMS < 1.8.3 - SQL Injection via tutor_answering_quiz_question/get_answer_by_idEPSS 1.3%CVE-2021-24181—Tutor LMS < 1.7.7 - SQL Injection via tutor_mark_answer_as_correctEPSS 1.3%CVE-2020-3936CRITICALUnisoon UltraLog Express - SQL InjectionEPSS 1.2%CVE-2025-50455CRITICALSQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1.EPSS 1.2%CVE-2023-36189HIGHSQL injection vulnerability in langchain before v0.0.247 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain cEPSS 1.2%CVE-2021-1222MEDIUMCisco Smart Software Manager Satellite SQL Injection VulnerabilityEPSS 1.2%CVE-2021-37497CRITICALSQL injection vulnerability in route of PbootCMS 3.0.5 allows remote attackers to run arbitrary SQL commands via crafted GET request.EPSS 1.2%CVE-2023-48118CRITICALSQL Injection vulnerability in Quest Analytics LLC IQCRM v.2023.9.5 allows a remote attacker to execute arbitrary code via a crafted requestEPSS 1.2%CVE-2022-39041CRITICALaEnrich a+HRD - SQL InjectionEPSS 1.2%CVE-2024-54820CRITICALXOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page. This vulnerabiEPSS 1.2%CVE-2020-29168CRITICALSQL Injection vulnerability in Projectworlds Online Doctor Appointment Booking System, allows attackers to gain sensitive information via thEPSS 1.2%CVE-2017-11161—Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary EPSS 1.2%CVE-2022-24628HIGHAn issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is authenticated SQL injection in the id parameter EPSS 1.2%CVE-2023-47460HIGHSQL injection vulnerability in Knovos Discovery v.22.67.0 allows a remote attacker to execute arbitrary code via the /DiscoveryProcess/ServiEPSS 1.2%CVE-2021-24142—301 Redirects - Easy Redirect Manager < 2.51 - Authenticated SQL InjectionEPSS 1.2%CVE-2022-42064CRITICALOnline Diagnostic Lab Management System version 1.0 remote exploit that bypasses login with SQL injection and then uploads a shell.EPSS 1.2%