Weaknesses of type CWE-89

13,065 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2023-26584CRITICALUnauthenticated SQL Injection In IDAttend’s IDWeb ApplicationEPSS 0.6%CVE-2025-28873HIGHWordPress Shuffle plugin <= 0.5 - SQL Injection vulnerabilityEPSS 0.6%CVE-2023-26582CRITICALUnauthenticated SQL Injection In IDAttend’s IDWeb ApplicationEPSS 0.6%CVE-2022-2708MEDIUMSourceCodester Gym Management System login.php sql injectionEPSS 0.6%CVE-2023-27260CRITICALUnauthenticated SQL Injection In IDAttend’s IDWeb ApplicationEPSS 0.6%CVE-2025-3553MEDIUMphpshe admin.php pe_delete sql injectionEPSS 0.6%CVE-2025-3589MEDIUMSourceCodester Music Class Enrollment System manage_class.php sql injectionEPSS 0.6%CVE-2023-5785MEDIUMNetentsec NS-ASG Application Security Gateway addaddress_interpret.php sql injectionEPSS 0.6%CVE-2023-50061CRITICALPrestaShop Op'art Easy Redirect >= 1.3.8 and <= 1.3.12 is vulnerable to SQL Injection via Oparteasyredirect::hookActionDispatcher().EPSS 0.6%CVE-2025-13294CRITICALUnauthenticated SQL InjectionEPSS 0.6%CVE-2026-7048MEDIUMPhoto Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode AttributeEPSS 0.6%CVE-2026-11421MEDIUMERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' ParameterEPSS 0.6%CVE-2024-7365MEDIUMSourceCodester Tracking Monitoring Management System manage_establishment.php sql injectionEPSS 0.6%CVE-2024-7377MEDIUMSourceCodester Simple Realtime Quiz System view_result.php sql injectionEPSS 0.6%CVE-2026-14029MEDIUMGroundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' ParameterEPSS 0.6%CVE-2024-12794MEDIUMCodezips E-Commerce Site editorder.php sql injectionEPSS 0.6%CVE-2026-9767MEDIUMThe School Management <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' ParameterEPSS 0.6%CVE-2024-7499MEDIUMitsourcecode Airline Reservation System flights.php sql injectionEPSS 0.6%CVE-2026-12110MEDIUMTaskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'task_search' ParameterEPSS 0.6%CVE-2023-38519HIGHWordPress MainWP Plugin <= 4.4.3.3 is vulnerable to SQL InjectionEPSS 0.6%