Weaknesses of type CWE-89

12,759 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2024-39887MEDIUMApache Superset: Improper SQL authorisation, parse not checking for specific engine functionsEPSS 4.4%CVE-2022-33965CRITICALWordPress WP Visitor Statistics plugin <= 5.7 - Multiple Unauthenticated SQL Injection (SQLi) vulnerabilitiesEPSS 4.4%CVE-2023-34752CRITICALbloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&acEPSS 4.4%CVE-2024-36516HIGHSQL InjectionEPSS 4.4%CVE-2018-5384—Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injectionEPSS 4.4%CVE-2026-48134MEDIUMSQL injection issue in UserCheck Portal when DLP Software Blade is activeEPSS 4.4%CVE-2020-5726—The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. A remote unauthenticated EPSS 4.3%CVE-2024-7854CRITICALWoo Inquiry <= 0.1 - Unauthenticated SQL InjectionEPSS 4.3%CVE-2023-31702HIGHSQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to dump entire database EPSS 4.3%CVE-2022-46071CRITICALThere is SQL Injection vulnerability at Helmet Store Showroom v1.0 Login Page. This vulnerability can be exploited to bypass admin access.EPSS 4.3%CVE-2022-38627CRITICALNortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a SQL injEPSS 4.3%CVE-2022-45808CRITICALWordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL InjectionEPSS 4.3%CVE-2012-5861—Sinapsi eSolar SQL InjectionEPSS 4.2%CVE-2023-34755CRITICALbloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the userid parameter at admin/index.php?mode=user&action=edit.EPSS 4.2%CVE-2023-34756CRITICALbloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=settings&page=charsetEPSS 4.2%CVE-2023-34753CRITICALbloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the tid parameter at admin/index.php?mode=settings&page=tmpl&acEPSS 4.2%CVE-2023-34751CRITICALbloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the gid parameter at admin/index.php?mode=user&page=groups&actiEPSS 4.2%CVE-2024-3605CRITICALWP Hotel Booking <= 2.1.0 - Unauthenticated SQL InjectionEPSS 4.2%CVE-2023-2130MEDIUMSourceCodester Purchase Order Management System GET Parameter view_details.php sql injectionEPSS 4.1%CVE-2026-48136MEDIUMAuthenticated Administrator Role-Based Access Control Bypass in ComplianceEPSS 4.1%