Falhas do tipo CWE-89

13.391 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2026-25418HIGHWordPress Bit Form plugin <= 2.21.10 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-67517HIGHWordPress ArtPlacer Widget plugin <= 2.22.9.2 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-67518HIGHWordPress Accordion Slider PRO plugin <= 1.2 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-56380MEDIUMFrappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_valueEPSS 0.3%CVE-2026-40455HIGHSQL Injection in LMSEPSS 0.3%CVE-2025-54026HIGHWordPress GymBase Theme Classes plugin <= 1.4 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-29529MEDIUMITC Systems Multiplan/Matrix OneCard platform v3.7.4.1002 was discovered to contain a SQL injection vulnerability via the component ForgotpaEPSS 0.3%CVE-2026-97883MEDIUMmathurvishal CloudClassroom-PHP-Project updatequery.php sql injectionEPSS 0.3%CVE-2026-10110MEDIUMcode-projects Student Details Management System index.php sql injectionEPSS 0.3%CVE-2025-52822HIGHWordPress WP Roadmap plugin <= 2.1.3 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-52821HIGHWordPress Video List Manager plugin <= 1.7 - SQL Injection VulnerabilityEPSS 0.3%CVE-2024-43018MEDIUMPiwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register. These parameters are used in ws_user_geEPSS 0.3%CVE-2026-10607MEDIUMDedeCMS flink.php dede_htmlspecialchars sql injectionEPSS 0.3%CVE-2024-9149HIGHSQLi in Wind Media's E-Commerce Website TemplateEPSS 0.3%CVE-2026-38467MEDIUMA SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows reEPSS 0.3%CVE-2025-34245MEDIUMAdvantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxStandaloneVpnClientsController.ajaxAction()EPSS 0.3%CVE-2025-34241MEDIUMAdvantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxDeviceController.ajaxDeviceAction()EPSS 0.3%CVE-2025-34246MEDIUMAdvantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxPrevalidationController.ajaxAction()EPSS 0.3%CVE-2025-15142MEDIUM9786 phpok3w show.php sql injectionEPSS 0.3%CVE-2025-34242HIGHAdvantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxNetworkController.ajaxAction()EPSS 0.3%