Weaknesses of type CWE-89

13,084 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2024-37090HIGHSQL Injection vulnerability in multiple StylemixThemes premium themesEPSS 0.5%CVE-2026-63233CRITICALSQL injection and unsafe deserialisation vulnerabilityEPSS 0.5%CVE-2023-51547HIGHWordPress Fluent Support Plugin <= 1.7.6 is vulnerable to SQL InjectionEPSS 0.5%CVE-2023-50851HIGHWordPress Simply Schedule Appointments Plugin < 1.6.6.1 is vulnerable to SQL InjectionEPSS 0.5%CVE-2025-30886CRITICALWordPress JS Help Desk plugin <= 2.9.2 - SQL Injection vulnerabilityEPSS 0.5%CVE-2026-73670HIGHCMS Admin SQL Injection via db_data.php table_name ParameterEPSS 0.5%CVE-2023-50852HIGHWordPress BookIt Plugin <= 2.4.3 is vulnerable to SQL InjectionEPSS 0.5%CVE-2025-1768MEDIUMSEO Plugin by Squirrly SEO <= 12.4.05 - Authenticated (Subscriber+) SQL Injection via search ParameterEPSS 0.5%CVE-2026-63232CRITICALSQL injection and unsafe deserialisation vulnerabilityEPSS 0.5%CVE-2023-50855HIGHWordPress Pre* Party Resource Hints Plugin <= 1.8.18 is vulnerable to SQL InjectionEPSS 0.5%CVE-2023-50857HIGHWordPress Automation By Autonami Plugin <= 2.6.1 is vulnerable to SQL InjectionEPSS 0.5%CVE-2023-50849HIGHWordPress e2pdf Plugin <= 1.20.23 is vulnerable to SQL InjectionEPSS 0.5%CVE-2023-53734HIGHdawa-pharma-1.0 - SQL Injection via Email ParameterEPSS 0.5%CVE-2026-63234CRITICALSQL injection and unsafe deserialisation vulnerabilityEPSS 0.5%CVE-2023-50843HIGHWordPress Clockwork SMS Notfications Plugin <= 3.0.4 is vulnerable to SQL InjectionEPSS 0.5%CVE-2024-8150MEDIUMContiNew Admin user sql injectionEPSS 0.5%CVE-2024-33546CRITICALWordPress WZone plugin <= 14.0.10 - Arbitrary SQL Update Execution vulnerabilityEPSS 0.5%CVE-2024-42552HIGHHotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the book_id parameter at admin_room_histoEPSS 0.5%CVE-2026-44447HIGHERPNext: Possibility of SQL Injection due to missing validationEPSS 0.5%CVE-2023-50847HIGHWordPress Welcart e-Commerce Plugin <= 2.9.3 is vulnerable to SQL InjectionEPSS 0.5%