Falhas do tipo CWE-89

13.406 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2025-14259MEDIUMJihai Jshop MiniProgram Mall System api.html sql injectionEPSS 0.2%CVE-2025-14780MEDIUMXiongwei Smart Catering Cloud Platform dish_trade_detail_get sql injectionEPSS 0.2%CVE-2025-68060HIGHWordPress Team Member plugin <= 8.5 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-20061MEDIUMCisco Unity Connection SQL Injection VulnerabilityEPSS 0.2%CVE-2026-111472CRITICALSQL injection in TSG ProfleetEPSS 0.2%CVE-2026-12260CRITICALSQL injection in the NetBoard CRM demo platformEPSS 0.2%CVE-2026-13695HIGHSQL Injection in the Integratec ApplicationEPSS 0.2%CVE-2021-47980HIGHFuel CMS 1.4.13 Blind SQL Injection via col ParameterEPSS 0.2%CVE-2026-42714HIGHWordPress Pix por Piggly (para Woocommerce) plugin <= 2.1.2 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-96826HIGHWordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-42710HIGHWordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-42708HIGHWordPress WP Post Author plugin <= 4.0.0 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-109687HIGHWordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-62097HIGHWordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-42720HIGHWordPress Dynamic User Directory plugin <= 2.4 - SQL Injection vulnerabilityEPSS 0.2%CVE-2019-25746HIGHWordPress Sliced Invoices 3.8.2 SQL Injection via post ParameterEPSS 0.2%CVE-2026-105076HIGHWordPress Vitepos plugin <= 3.6.1 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-62060HIGHWordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-42713HIGHWordPress Post title marquee scroll plugin <= 9.9 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-42721HIGHWordPress affiliate-toolkit plugin <= 3.9.1 - SQL Injection vulnerabilityEPSS 0.2%