Falhas do tipo CWE-89

13.416 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2026-28576CRITICALIn Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disEPSS 0.2%CVE-2024-33501MEDIUMTwo improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in Fortinet FortiAnalyzer veEPSS 0.2%CVE-2024-55159MEDIUMGFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the SortName parameter at /system/loginLog/list.EPSS 0.2%CVE-2026-40131LOWSQL Injection vulnerability in SAP HANA Deployment Infrastructure (HDI) deploy libraryEPSS 0.2%CVE-2026-6638LOWPostgreSQL REFRESH PUBLICATION allows SQL injection via table nameEPSS 0.2%CVE-2026-51936LOWZetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher_export convenience function can be used to copy the contents of one attaEPSS 0.2%CVE-2024-12913HIGHSQLi in Megatek Communication System's Azora Wireless Network ManagementEPSS 0.2%CVE-2026-15829HIGHSQL Injection and Security Boundary Bypass in googleapis/mcp-toolboxEPSS 0.2%CVE-2026-101046LOWFleet before 4.89.0 SQL Injection via ORDER BY Activity EndpointsEPSS 0.2%CVE-2025-6230MEDIUMA SQL injection vulnerability was reported in Lenovo Vantage that could allow a local attacker to modify the local SQLite database and execuEPSS 0.2%CVE-2026-94348MEDIUMDell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQEPSS 0.2%CVE-2026-87938—CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136EPSS 0.2%CVE-2025-52646LOWHCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries.EPSS 0.1%CVE-2026-89303MEDIUMPost Voting System <= 1.0 - Subscriber+ SQLi via 'row' ParameterEPSS 0.1%CVE-2025-55703LOWAn error-based SQL injection vulnerability exists in the Sunbird Power IQ 9.2.0 API. The vulnerability is due to an outdated API endpoint thEPSS 0.1%CVE-2024-14025LOWVideo StationEPSS 0.1%CVE-2025-49211HIGHA SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affectedEPSS 0.1%CVE-2025-49218HIGHA post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges oEPSS 0.1%CVE-2026-11475MEDIUMKushan2k student-management-system Certificate Verification Endpoint GradeController.php getStatus sql injectionEPSS 0.1%CVE-2026-1907HIGHSQL Injection in Clustering Communication (Hybrid Mode)EPSS 0.1%