Weaknesses of type CWE-89

12,989 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2023-35066CRITICALSQLi in Infodrom Sofwares E-Invoice Approval SystemEPSS 0.6%CVE-2023-3716CRITICALSQLi in Oduyo Online Collection SoftwareEPSS 0.6%CVE-2023-3046CRITICALSQLi in Biltay Technlogys ScientaEPSS 0.6%CVE-2023-33178MEDIUMSensitive Information Disclosure abusing SQL Injection in Xibo CMS dataset filterEPSS 0.6%CVE-2025-59681HIGHAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySeEPSS 0.6%CVE-2023-30750HIGHWordPress CM Pop-Up banners Plugin <= 1.5.10 is vulnerable to SQL InjectionEPSS 0.6%CVE-2023-1909MEDIUMPHPGurukul BP Monitoring Management System User Profile Update profile.php sql injectionEPSS 0.6%CVE-2023-30495HIGHWordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL InjectionEPSS 0.6%CVE-2022-35942CRITICALloopback-connector-postgresql Vulnerable to Improper Sanitization of `contains` FilterEPSS 0.6%CVE-2024-2149MEDIUMCodeAstro Membership Management System settings.php sql injectionEPSS 0.6%CVE-2023-49776CRITICALWordPress Sayfa Sayaç Plugin <= 2.6 is vulnerable to SQL InjectionEPSS 0.6%CVE-2023-26033HIGHGentoo soko contains DoS attack based on SQL InjectionEPSS 0.6%CVE-2024-11722MEDIUMFrontend Admin by DynamiApps <= 3.25.1 - Unauthenticated SQL InjectionEPSS 0.6%CVE-2023-3791MEDIUMIBOS OA Personal Office Address Book export actionExport sql injectionEPSS 0.6%CVE-2022-42923HIGHSQL injection in Forma LMSEPSS 0.6%CVE-2024-11241MEDIUMcode-projects Job Recruitment reset.php sql injectionEPSS 0.6%CVE-2022-45589HIGHAll versions before 8.0.1-R2022-10-RT and 7.3.1-R2022-09-RT of the Talend ESB Runtime are potentially vulnerable to SQL Injection attacks inEPSS 0.6%CVE-2023-5032MEDIUMOpenRapid RapidCMS article-edit-run.php sql injectionEPSS 0.6%CVE-2024-0502MEDIUMSourceCodester House Rental Management System Edit User manage_user.php sql injectionEPSS 0.6%CVE-2025-32124HIGHWordPress Behance Portfolio Manager plugin <= 1.7.5 - SQL Injection vulnerabilityEPSS 0.6%