Falhas do tipo CWE-89

13.394 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2018-25172HIGHPedidos 1.0 SQL Injection via load_proveedores.phpEPSS 0.3%CVE-2019-25521HIGHXooGallery Lastest Latest SQL Injection via gal.php gal_idEPSS 0.3%CVE-2025-30022MEDIUMCM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the DATANASC parameter.EPSS 0.3%CVE-2026-114065HIGHTrigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table PlaceholdersEPSS 0.3%CVE-2025-41004HIGHMultiple vulnerabilities in Imaster products Open configuration optionsEPSS 0.3%CVE-2025-41005HIGHMultiple vulnerabilities in Imaster products Open configuration optionsEPSS 0.3%CVE-2025-22209MEDIUMExtension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for JoomlaEPSS 0.3%CVE-2026-110911CRITICALWheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOEPSS 0.3%CVE-2025-13385MEDIUMBookme <= 4.2 - Authenticated (Admin+) SQL Injection via 'filter[status]' ParameterEPSS 0.3%CVE-2024-34933MEDIUMA SQL injection vulnerability in /model/update_grade.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to EPSS 0.3%CVE-2026-104456HIGHYesWiki before 4.6.7 Second-Order SQL Injection via ACL UsernameEPSS 0.3%CVE-2024-33804MEDIUMA SQL injection vulnerability in /model/get_subject.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to eEPSS 0.3%CVE-2026-79811HIGHAuthenticated SQL Injection allows Remote Code Execution in ClearPass Policy Manager APIEPSS 0.3%CVE-2026-17418HIGHIBM i is Affected By Multiple Vulnerabilities in SQLEPSS 0.3%CVE-2026-79794CRITICALAuthenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management InterfaceEPSS 0.3%CVE-2026-76309MEDIUMStructured Query Language (SQL) Injection through the REST API in Splunk EnterpriseEPSS 0.3%CVE-2025-10002MEDIUMClickWhale <= 2.5.0 - Authenticated (Admin+) SQL injectionEPSS 0.3%CVE-2015-10146MEDIUMThumbnail Slider With Lightbox <= 1.0.4 - Authenticated (Admin+) SQL InjectionEPSS 0.3%CVE-2015-10147MEDIUMEasy Testimonial Slider and Form <= 1.0.2 - Authenticated (Admin+) SQL injectionEPSS 0.3%CVE-2025-10048MEDIUMMy Auctions Allegro Plugin <= 3.6.31 - Authenticated (Admin+) SQL InjectionEPSS 0.3%