Weaknesses of type CWE-89

12,895 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2023-2074MEDIUMCampcodes Online Traffic Offense Management System Master.php sql injectionEPSS 0.8%CVE-2023-5466HIGHWp anything slider <= 9.1 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-43794MEDIUMSQL Injection in nocodbEPSS 0.8%CVE-2022-29822CRITICALFeathers - Improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injectionEPSS 0.8%CVE-2023-2037MEDIUMCampcodes Video Sharing Website watch.php sql injectionEPSS 0.8%CVE-2023-1039HIGHSourceCodester Class and Exam Timetabling System POST Parameter index3.php sql injectionEPSS 0.8%CVE-2022-2422CRITICALFeathers - SQL injection via attribute aliasesEPSS 0.8%CVE-2023-1301MEDIUMSourceCodester Friendly Island Pizza Website and Ordering System GET Parameter deleteorder.php sql injectionEPSS 0.8%CVE-2023-2366MEDIUMSourceCodester Faculty Evaluation System sql injectionEPSS 0.8%CVE-2023-1300MEDIUMSourceCodester COVID 19 Testing Management System POST Parameter patient-report.php sql injectionEPSS 0.8%CVE-2023-5428HIGHImage vertical reel scroll slideshow <= 9.0 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-30850HIGHPimcore SQL Injection Vulnerability in Admin Translations APIEPSS 0.8%CVE-2023-30849HIGHPimcore vulnerable to SQL Injection in Translation Export APIEPSS 0.8%CVE-2026-9668MEDIUMSQL injection vulnerability in ZTE SCP productEPSS 0.8%CVE-2024-31010HIGHSQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Banner.php.EPSS 0.8%CVE-2023-1311MEDIUMSourceCodester Friendly Island Pizza Website and Ordering System GET Parameter large.php sql injectionEPSS 0.8%CVE-2023-5433HIGHMessage ticker <= 9.2 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-5429HIGHInformation Reel <= 10.0 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-5430HIGHJquery news ticker <= 3.0 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-5438HIGHwp image slideshow <= 12.0 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 0.8%