Weaknesses of type CWE-89

13,074 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2025-4865MEDIUMitsourcecode Restaurant Management System member_save.php sql injectionEPSS 0.5%CVE-2024-7190MEDIUMitsourcecode Society Management System get_price.php sql injectionEPSS 0.5%CVE-2026-1133MEDIUMYonyou KSOA HTTP GET Parameter folder.jsp sql injectionEPSS 0.5%CVE-2024-10023MEDIUMcode-projects Pharmacy Management System add_new_medicine.php sql injectionEPSS 0.5%CVE-2024-51606HIGHWordPress Blrt WP Embed plugin <= 1.6.9 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-12785MEDIUMitsourcecode Vehicle Management System sendmail.php sql injectionEPSS 0.5%CVE-2025-4870MEDIUMitsourcecode Restaurant Management System menu_save.php sql injectionEPSS 0.5%CVE-2025-4881MEDIUMitsourcecode Restaurant Management System user_save.php sql injectionEPSS 0.5%CVE-2025-22957CRITICALA SQL injection vulnerability exists in the front-end of the website in ZZCMS <= 2023, which can be exploited without any authentication. ThEPSS 0.5%CVE-2025-57515CRITICALA SQL injection vulnerability has been identified in Uniclare Student Portal v2. This flaw allows remote attackers to inject arbitrary SQL cEPSS 0.5%CVE-2025-0874MEDIUMcode-projects Simple Plugins Car Rental Management approve.php sql injectionEPSS 0.5%CVE-2025-2036MEDIUMs-a-zhd Ecommerce-Website-using-PHP details.php sql injectionEPSS 0.5%CVE-2026-44635HIGHKysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`EPSS 0.5%CVE-2025-3708CRITICALLe-show Medical Practice Management System - SQL InjectionEPSS 0.5%CVE-2024-7607HIGHFront End Users <= 3.2.28 - Authenticated (Contributor+) Time-Based SQL InjectionEPSS 0.5%CVE-2024-37872HIGHSQL injection vulnerability in process.php in Itsourcecode Billing System in PHP 1.0 allows remote attackers to execute arbitrary SQL commanEPSS 0.5%CVE-2025-1380MEDIUMCodezips Gym Management System del_plan.php sql injectionEPSS 0.5%CVE-2025-0336MEDIUMCodezips Project Management System teacher.php sql injectionEPSS 0.5%CVE-2025-1820MEDIUMzj1983 zz ZworkflowAction.java getOaWid sql injectionEPSS 0.5%CVE-2026-85540HIGHInterinfo｜DreamMaker - SQL InjectionEPSS 0.5%