Weaknesses of type CWE-89

13,083 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2025-0173MEDIUMSourceCodester Online Eyewear Shop view_order.php sql injectionEPSS 0.5%CVE-2024-6274MEDIUMlahirudanushka School Management System Attendance Report Page attendancelist.php sql injectionEPSS 0.5%CVE-2024-1839CRITICALIntrado 911 Emergency Gateway login form is vulnerable to an unauthenticated blind time-based SQL injection, which may allow an unauthenticaEPSS 0.5%CVE-2025-25775CRITICALCodeastro Bus Ticket Booking System v1.0 is vulnerable to SQL injection via the kodetiket parameter in /BusTicket-CI/tiket/cekorder.EPSS 0.5%CVE-2025-31553CRITICALWordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.1 - SQL Injection vulnerabilityEPSS 0.5%CVE-2022-3013MEDIUMSourceCodester Simple Task Managing System loginVaLidation.php sql injectionEPSS 0.5%CVE-2024-52474CRITICALWordPress Express Payments plugin <= 1.1.8 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-5589MEDIUMNetentsec NS-ASG Application Security Gateway sql injectionEPSS 0.5%CVE-2026-3287MEDIUMyoulaitech youlai-mall App-side Product Pagination Endpoint SpuController.java listPagedSpuForApp sql injectionEPSS 0.5%CVE-2023-52142HIGHWordPress Events Shortcodes & Templates For The Events Calendar Plugin <= 2.3.1 is vulnerable to SQL InjectionEPSS 0.5%CVE-2024-11213MEDIUMSourceCodester Best Employee Management System edit_role.php sql injectionEPSS 0.5%CVE-2023-52201HIGHWordPress pTypeConverter Plugin <= 0.2.8.1 is vulnerable to SQL InjectionEPSS 0.5%CVE-2025-5119MEDIUMEmlog Pro api_controller.php sql injectionEPSS 0.5%CVE-2024-37840HIGHSQL injection vulnerability in processscore.php in Itsourcecode Learning Management System Project In PHP With Source Code v1.0 allows remotEPSS 0.5%CVE-2026-54350CRITICALBudibase: Anonymous NoSQL operator injection via published-app query templatesEPSS 0.5%CVE-2024-54361CRITICALWordPress Instant Appointment plugin <= 1.2 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-55977CRITICALWordPress LaunchPage.app Importer plugin <= 1.1 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-12938MEDIUMcode-projects Simple Admin Panel updateOrderStatus.php sql injectionEPSS 0.5%CVE-2019-25510HIGHJettweb PHP Hazir Haber Sitesi Scripti V2 Authentication BypassEPSS 0.5%CVE-2025-65950CRITICALWBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups[] ParameterEPSS 0.5%