Falhas do tipo CWE-89

12.874 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2022-39179HIGHCollege Management System v1.0 - Authenticated remote code executionEPSS 1.1%CVE-2020-21400HIGHSQL injection vulnerability in gaozhifeng PHPMyWind v.5.6 allows a remote attacker to execute arbitrary code via the id variable in the modiEPSS 1.1%CVE-2020-20491HIGHSQL injection vulnerability in OpenCart v.2.2.00 thru 3.0.3.2 allows a remote attacker to execute arbitrary code via the Fba plugin functionEPSS 1.1%CVE-2024-8944MEDIUMcode-projects Hospital Management System check_availability.php sql injectionEPSS 1.1%CVE-2025-59499HIGHMicrosoft SQL Server Elevation of Privilege VulnerabilityEPSS 1.1%CVE-2022-2214MEDIUMSourceCodester Library Management System bookdetails.php sql injectionEPSS 1.1%CVE-2022-3300HIGHForm Maker by 10Web < 1.15.6 - Admin+ SQLIEPSS 1.1%CVE-2024-2014HIGHPanabit Panalog sprog_upstatus.php sql injectionEPSS 1.1%CVE-2022-3246HIGHBlog2Social < 6.9.10 - Subscriber+ SQLiEPSS 1.1%CVE-2021-42333HIGHHuachu Digital Technology Co.,Ltd. Easytest - SQL Injection-1EPSS 1.1%CVE-2021-42334HIGHHuachu Digital Technology Co.,Ltd. Easytest - SQL Injection-2EPSS 1.1%CVE-2024-55573CRITICALAn issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.EPSS 1.1%CVE-2022-24831HIGHImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in OpenClinicaEPSS 1.1%CVE-2022-24848HIGHSQL Injection in DHIS2's in OrgUnit program associationEPSS 1.1%CVE-2017-20104HIGHSimplessus Cookie Time sql injectionEPSS 1.1%CVE-2023-37177CRITICALSQL Injection vulnerability in PMB Services PMB v.7.4.7 and before allows a remote unauthenticated attacker to execute arbitrary code via thEPSS 1.1%CVE-2021-3935—When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection iEPSS 1.1%CVE-2021-41433CRITICALSQL Injection vulnerability exists in version 1.0 of the Resumes Management and Job Application Website application login form by EGavilan MEPSS 1.1%CVE-2022-40943CRITICALDairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via bwdate-report-ds.php file.EPSS 1.1%CVE-2025-47608CRITICALWordPress Recover abandoned cart for WooCommerce plugin <= 2.5 - SQL Injection VulnerabilityEPSS 1.1%