Weaknesses of type CWE-89

13,084 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2023-4541CRITICALSQLi in Weens Admin PanelEPSS 0.5%CVE-2024-9315MEDIUMSourceCodester Employee and Visitor Gate Pass Logging System manage_department.php sql injectionEPSS 0.5%CVE-2026-27834HIGHPiwigo: SQL Injection in pwg.users.getList API Method via filter ParameterEPSS 0.5%CVE-2024-9317MEDIUMSourceCodester Online Eyewear Shop Master.php delete_category sql injectionEPSS 0.5%CVE-2024-7290MEDIUMSourceCodester Establishment Billing Management System manage_tenant.php sql injectionEPSS 0.5%CVE-2024-28145MEDIUMUnauthenticated SQL InjectionEPSS 0.5%CVE-2026-5577MEDIUMSong-Li cross_browser details Endpoint uniquemachine_app.py sql injectionEPSS 0.5%CVE-2024-6215MEDIUMSourceCodester Food Ordering Management System view-ticket-admin.php sql injectionEPSS 0.5%CVE-2024-44727HIGHSourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php.EPSS 0.5%CVE-2024-35350CRITICALA vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the EPSS 0.5%CVE-2024-3518HIGHMedia Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via ShortcodeEPSS 0.5%CVE-2024-8621CRITICALDaily Prayer Time <= 2024.08.26 - Authenticated (Contributor+) SQL InjectionEPSS 0.5%CVE-2026-12076CRITICALSQL Injection in Raytha CMSEPSS 0.5%CVE-2024-48411CRITICALitsourcecode Online Tours and Travels Management System v1.0 is vulnerable to SQL Injection (SQLI) via a crafted payload to the val-email paEPSS 0.5%CVE-2026-1593MEDIUMitsourcecode Society Management System edit_expenses_query.php sql injectionEPSS 0.5%CVE-2026-40906CRITICALElectric: SQL Injection via ORDER BY Parameter in Shape APIEPSS 0.5%CVE-2024-9574CRITICALSQL Injection vulnerability in SOPlanningEPSS 0.5%CVE-2024-12032MEDIUMTourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking <= 2.15.3 - Authenticated (Subscriber+) SQL InjectionEPSS 0.5%CVE-2026-57309CRITICALBlind SQL Injection in Windu CMSEPSS 0.5%CVE-2026-15067HIGHMultiple Security Vulnerabilities in Terraform Provider for Snowflake Could Allow Privilege Escalation and Unauthorized Snowflake Account TakeoverEPSS 0.5%