Weaknesses of type CWE-89

13,546 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2019-12681HIGHCisco Firepower Management Center SQL Injection VulnerabilitiesEPSS 3.0%CVE-2019-12682HIGHCisco Firepower Management Center SQL Injection VulnerabilitiesEPSS 3.0%CVE-2019-12686HIGHCisco Firepower Management Center SQL Injection VulnerabilitiesEPSS 3.0%CVE-2019-12683HIGHCisco Firepower Management Center SQL Injection VulnerabilitiesEPSS 3.0%CVE-2019-12680HIGHCisco Firepower Management Center SQL Injection VulnerabilitiesEPSS 3.0%CVE-2025-1323HIGHWP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Unauthenticated SQL InjectionEPSS 2.9%CVE-2020-25638HIGHA flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA CriteriEPSS 2.9%CVE-2020-13500CRITICALSQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. SpecEPSS 2.9%CVE-2020-13501CRITICALAn SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. SEPSS 2.9%CVE-2020-13499CRITICALAn SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. SEPSS 2.9%CVE-2022-34871HIGHThis vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploEPSS 2.9%CVE-2024-8911CRITICALLatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL InjectionEPSS 2.9%CVE-2022-27479—SQL injection vulnerability in chart data APIEPSS 2.9%CVE-2022-42426HIGHThis vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploEPSS 2.9%CVE-2022-42428HIGHThis vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploEPSS 2.9%CVE-2021-35234HIGHExposed Dangerous Functions - Privileged EscalationEPSS 2.9%CVE-2021-24385—Filebird 4.7.3 - Unauthenticated SQL InjectionEPSS 2.8%CVE-2022-2272CRITICALThis vulnerability allows remote attackers to bypass authentication on affected installations of Sante PACS Server 3.0.4. Authentication is EPSS 2.8%CVE-2023-6575MEDIUMByzoro S210 HTTP POST Request repair.php sql injectionEPSS 2.8%CVE-2024-25833CRITICALF-logic DataCube3 v1.0 is vulnerable to unauthenticated SQL injection, which could allow an unauthenticated malicious actor to execute arbitEPSS 2.8%