Weaknesses of type CWE-89

13,065 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2025-6420MEDIUMcode-projects Simple Online Hotel Reservation System add_room.php sql injectionEPSS 0.5%CVE-2024-54284HIGHWordPress SeedProd Pro plugin <= 6.18.10 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-6580MEDIUMSourceCodester Best Salon Management System Login sql injectionEPSS 0.5%CVE-2024-30237HIGHWordPress Slider by Supsystic plugin <= 1.8.10 - SQL Injection vulnerabilityEPSS 0.5%CVE-2023-45046MEDIUMWordPress Pressference Exporter Plugin <= 1.0.3 is vulnerable to SQL InjectionEPSS 0.5%CVE-2024-41915HIGHAuthenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management InterfaceEPSS 0.5%CVE-2023-43640MEDIUMTaxonWorks SQL injection vulnerabilityEPSS 0.5%CVE-2025-5604MEDIUMCampcodes Hospital Management System user-login.php sql injectionEPSS 0.5%CVE-2025-5603MEDIUMCampcodes Hospital Management System registration.php sql injectionEPSS 0.5%CVE-2025-8166MEDIUMcode-projects Church Donation System HTTP POST Request index.php sql injectionEPSS 0.5%CVE-2023-35720MEDIUMASUS RT-AX92U lighttpd mod_webdav.so SQL Injection Information Disclosure VulnerabilityEPSS 0.5%CVE-2025-6409MEDIUMPHPGurukul Art Gallery Management System forgot-password.php sql injectionEPSS 0.5%CVE-2025-5663MEDIUMPHPGurukul Auto Taxi Stand Management System search-autoortaxi.php sql injectionEPSS 0.5%CVE-2025-6489MEDIUMitsourcecode Agri-Trading Online Shopping System transactionsave.php sql injectionEPSS 0.5%CVE-2024-53438CRITICALEventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability by manipulating the 'EventEPSS 0.5%CVE-2025-6419MEDIUMcode-projects Simple Online Hotel Reservation System edit_room.php sql injectionEPSS 0.5%CVE-2025-5856MEDIUMPHPGurukul BP Monitoring Management System registration.php sql injectionEPSS 0.5%CVE-2023-34418HIGHA valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vulnEPSS 0.5%CVE-2025-5602MEDIUMCampcodes Hospital Management System registration.php sql injectionEPSS 0.5%CVE-2026-3200MEDIUMz-9527 admin user.js getUsers sql injectionEPSS 0.5%