Falhas do tipo CWE-89

13.401 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2026-96828HIGHWordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-96346HIGHWordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-100752CRITICALJoomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9EPSS 0.3%CVE-2026-42717HIGHWordPress Leyka plugin <= 3.32.3 - SQL Injection vulnerabilityEPSS 0.3%CVE-2024-25528MEDIUMRuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_template_sEPSS 0.3%CVE-2026-101108CRITICALJoomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8EPSS 0.3%CVE-2025-39510HIGHWordPress Pinterest Automatic Pin plugin < 4.19.0 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-32993MEDIUMVision Helpdesk through 5.7.0 allows Time-Based Blind SQL injection via the Forgot Password (aka index.php?/home/forgot-password) vis_usernaEPSS 0.3%CVE-2026-42722HIGHWordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-104408HIGHWordPress Groundhogg plugin <= 4.8.3 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-88424CRITICALFineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). ThiEPSS 0.3%CVE-2026-94082HIGHWordPress Quiz Cat plugin <= 3.1.1 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-96345HIGHWordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-52924MEDIUMIn One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrusted X-RequestId HTTP rEPSS 0.3%CVE-2025-11740MEDIUMwpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL InjectionEPSS 0.3%CVE-2026-105317HIGHWordPress Paid Member Subscriptions plugin <= 3.1.1 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-105067HIGHWordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-15450MEDIUMsfturing hosp_order orderHos findOrderHosNum sql injectionEPSS 0.3%CVE-2026-109901HIGHWordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-62117HIGHWordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerabilityEPSS 0.3%