Weaknesses of type CWE-89

13,084 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2025-3142MEDIUMSourceCodester Apartment Visitor Management System add-apartment.php sql injectionEPSS 0.5%CVE-2023-5293MEDIUMECshop leancloud.php sql injectionEPSS 0.5%CVE-2024-50713CRITICALSmartAgent v1.1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tests/interface.php.EPSS 0.5%CVE-2026-4112HIGHImproper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote EPSS 0.5%CVE-2025-2736MEDIUMPHPGurukul Old Age Home Management System bwdates-report-details.php sql injectionEPSS 0.5%CVE-2026-73721HIGHAuthenticated SQL Injection Vulnerabilities in HPE Networking Fabric ComposerEPSS 0.5%CVE-2025-3267MEDIUMqinguoyi TinyWebServer http_conn.cpp sql injectionEPSS 0.5%CVE-2024-2588HIGHSQL injection vulnerability in AMSS++EPSS 0.5%CVE-2025-2381MEDIUMPHPGurukul Curfew e-Pass Management System search-pass.php sql injectionEPSS 0.5%CVE-2025-2362MEDIUMPHPGurukul Pre-School Enrollment System contact-us.php sql injectionEPSS 0.5%CVE-2024-10427MEDIUMCodezips Pet Shop Management System deleteanimal.php sql injectionEPSS 0.5%CVE-2025-2379MEDIUMPHPGurukul Apartment Visitors Management System create-pass.php sql injectionEPSS 0.5%CVE-2024-7454MEDIUMSourceCodester Clinics Patient Management System patients.php patient_name sql injectionEPSS 0.5%CVE-2025-2735MEDIUMPHPGurukul Old Age Home Management System add-services.php sql injectionEPSS 0.5%CVE-2025-2739MEDIUMPHPGurukul Old Age Home Management System manage-services.php sql injectionEPSS 0.5%CVE-2025-2380MEDIUMPHPGurukul Apartment Visitors Management System admin-profile.php sql injectionEPSS 0.5%CVE-2024-57633HIGHAn issue in the exps_bind_column component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL stEPSS 0.5%CVE-2024-10734MEDIUMProject Worlds Life Insurance Management System editPayment.php sql injectionEPSS 0.5%CVE-2024-6416MEDIUMSeaCMS sql injectionEPSS 0.5%CVE-2025-2847MEDIUMCodezips Gym Management System over_month.php sql injectionEPSS 0.5%