Weaknesses of type CWE-89

13,605 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2020-27660CRITICALSQL injection vulnerability in request.cgi in Synology SafeAccess before 1.2.3-0234 allows remote attackers to execute arbitrary SQL commandEPSS 4.6%CVE-2024-32738HIGHCyberPower PowerPanel Enterprise SQL InjectionEPSS 4.6%CVE-2024-39911CRITICAL1Panel SQL injectionEPSS 4.5%CVE-2024-5467HIGHSQL InjectionEPSS 4.5%CVE-2024-5556HIGHSQL InjectionEPSS 4.5%CVE-2024-36515HIGHSQL InjectionEPSS 4.5%CVE-2023-37270HIGHPiwigo SQL Injection vulnerability in "User-Agent"EPSS 4.5%CVE-2026-26990HIGHLibreNMS has Time-Based Blind SQL Injection in address-search.inc.phpEPSS 4.5%CVE-2024-47062CRITICALMultiple SQL Injections and ORM Leak in navidromeEPSS 4.5%CVE-2024-9459HIGHSQL InjectionEPSS 4.5%CVE-2024-39887MEDIUMApache Superset: Improper SQL authorisation, parse not checking for specific engine functionsEPSS 4.4%CVE-2023-34752CRITICALbloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&acEPSS 4.4%CVE-2024-36516HIGHSQL InjectionEPSS 4.4%CVE-2022-33965CRITICALWordPress WP Visitor Statistics plugin <= 5.7 - Multiple Unauthenticated SQL Injection (SQLi) vulnerabilitiesEPSS 4.4%CVE-2022-45808CRITICALWordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL InjectionEPSS 4.3%CVE-2020-5726—The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. A remote unauthenticated EPSS 4.3%CVE-2024-7854CRITICALWoo Inquiry <= 0.1 - Unauthenticated SQL InjectionEPSS 4.3%CVE-2023-31702HIGHSQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to dump entire database EPSS 4.3%CVE-2022-4093HIGH SQL Injection in dolibarr/dolibarrEPSS 4.3%CVE-2023-46748HIGHBIG-IP Configuration utility authenticated SQL injection vulnerabilityEPSS 4.3%KEV