Weaknesses of type CWE-89

12,837 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2024-8911CRITICALLatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL InjectionEPSS 2.9%CVE-2022-27479—SQL injection vulnerability in chart data APIEPSS 2.9%CVE-2025-1323HIGHWP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Unauthenticated SQL InjectionEPSS 2.9%CVE-2022-42426HIGHThis vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploEPSS 2.9%CVE-2022-42428HIGHThis vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploEPSS 2.9%CVE-2025-47178HIGHMicrosoft Configuration Manager Remote Code Execution VulnerabilityEPSS 2.9%CVE-2025-34112CRITICALRiverbed SteelCentral NetProfiler / NetExpress 10.8.7 RCEEPSS 2.9%CVE-2021-24385—Filebird 4.7.3 - Unauthenticated SQL InjectionEPSS 2.8%CVE-2023-6575MEDIUMByzoro S210 HTTP POST Request repair.php sql injectionEPSS 2.8%CVE-2024-25833CRITICALF-logic DataCube3 v1.0 is vulnerable to unauthenticated SQL injection, which could allow an unauthenticated malicious actor to execute arbitEPSS 2.8%CVE-2026-17191HIGHVeloCloud Orchestrator Flow Metrics API SQL InjectionEPSS 2.8%CVE-2018-1132HIGHA flaw was found in Opendaylight's SDNInterfaceapp (SDNI). Attackers can SQL inject the component's database (SQLite) without authenticatingEPSS 2.8%CVE-2022-45297CRITICALEQ v1.5.31 to v2.2.0 was discovered to contain a SQL injection vulnerability via the UserPwd parameter.EPSS 2.8%CVE-2021-35234HIGHExposed Dangerous Functions - Privileged EscalationEPSS 2.8%CVE-2021-21024CRITICALMagento Commerce Blind SQL Injection Could Lead To Unauthorized AccessEPSS 2.8%CVE-2022-34871HIGHThis vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploEPSS 2.8%CVE-2022-2272CRITICALThis vulnerability allows remote attackers to bypass authentication on affected installations of Sante PACS Server 3.0.4. Authentication is EPSS 2.7%CVE-2021-36520HIGHA SQL injection vulnerability in I-Tech Trainsmart r1044 exists via a evaluation/assign-evaluation?id= URI.EPSS 2.7%CVE-2022-45030HIGHA SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= (this may interact with securEPSS 2.7%CVE-2023-30192CRITICALPrestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find().EPSS 2.7%