Falhas do tipo CWE-89

13.406 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2019-25746HIGHWordPress Sliced Invoices 3.8.2 SQL Injection via post ParameterEPSS 0.2%CVE-2024-51102MEDIUMPHPGURUKUL Student Management System using PHP and MySQL v1 was discovered to contain multiple SQL injection vulnerabilities at /studentrecoEPSS 0.2%CVE-2026-63314HIGHSQL Injection in WebCTIEPSS 0.2%CVE-2026-111389HIGHFrappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing ValidationEPSS 0.2%CVE-2026-58225LOWSQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of serviceEPSS 0.2%CVE-2026-16593MEDIUMWP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget SettingsEPSS 0.2%CVE-2026-16596MEDIUMWP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' ParameterEPSS 0.2%CVE-2025-45021MEDIUMA SQL Injection vulnerability was identified in the admin/edit-directory.php file of the PHPGurukul Directory Management System v2.0. AttackEPSS 0.2%CVE-2025-63740MEDIUMSQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain senEPSS 0.2%CVE-2025-46154HIGHFoxcms v1.25 has a SQL time injection in the $_POST['dbname'] parameter of installdb.php.EPSS 0.2%CVE-2025-51045MEDIUMPhpgurukul Pre-School Enrollment System 1.0 contains a SQL injection vulnerability in the /admin/password-recovery.php file. This vulnerabilEPSS 0.2%CVE-2025-63948MEDIUMA SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute arbitrary SQL commandsEPSS 0.2%CVE-2025-51044MEDIUMphpgurukul Nipah virus (NiV) Testing Management System 1.0 contains a SQL injection vulnerability in the /new-user-testing.php file, due to EPSS 0.2%CVE-2025-68914MEDIUMRiello UPS NetMan 208 Application before 1.12 allows cgi-bin/login.cgi username SQL Injection. For example, an attacker can delete the LOGINEPSS 0.2%CVE-2026-108125HIGHWordPress Post Author Authenticated SQLiEPSS 0.2%CVE-2026-32687HIGHSQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3EPSS 0.2%CVE-2024-12706LOWSQL Injection vulnerability discovered in OpenText™ Digital Asset Management.EPSS 0.2%CVE-2025-60266MEDIUMIn xckk v9.6, there is a SQL injection vulnerability in which the orderBy parameter in address/list is not securely filtered, resulting in aEPSS 0.2%CVE-2022-20517MEDIUMIn getMessagesByPhoneNumber of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead toEPSS 0.2%CVE-2016-20063HIGHSingle Personal Message 1.0.3 WordPress Plugin SQL InjectionEPSS 0.2%