Weaknesses of type CWE-89

13,121 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2026-16146MEDIUMInvisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via Pattern JSON Keys/ValuesEPSS 0.5%CVE-2025-10444MEDIUMCampcodes Online Job Finder System advancesearch.php sql injectionEPSS 0.5%CVE-2025-25349CRITICALPHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Injection in /dets/add-expense.php via the costitem parameter.EPSS 0.5%CVE-2026-7618MEDIUMEnvíaloSimple: Email Marketing y Newsletters <= 2.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' ParameterEPSS 0.5%CVE-2025-11309MEDIUMTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findDeptPage.do doFilter sql injectionEPSS 0.5%CVE-2024-57768CRITICALJFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component validRoleKey?sysRole.key.EPSS 0.5%CVE-2024-5207HIGHPOST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL InjectionEPSS 0.5%CVE-2025-10857MEDIUMCampcodes Point of Sale System POS login.php sql injectionEPSS 0.5%CVE-2021-44161HIGHChanging Information Technology Inc. MOTP(Mobile One Time Password) - SQL InjectionEPSS 0.5%CVE-2026-25554HIGHOpenSIPS 3.1 <= 3.6.4 auth_jwt SQL Injection Enables JWT Authentication BypassEPSS 0.5%CVE-2025-25351CRITICALPHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Injection in /dets/add-expense.php via the dateexpense parameter.EPSS 0.5%CVE-2024-4902HIGHTutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL InjectionEPSS 0.5%CVE-2026-29073MEDIUMSiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database accessEPSS 0.5%CVE-2025-1321MEDIUMteachPress <= 9.0.7 - Authenticated (Contributor+) SQL InjectionEPSS 0.5%CVE-2024-57665CRITICALJFinalCMS 1.0 is vulnerable to SQL Injection in rc/main/java/com/cms/entity/Content.java. The cause of the vulnerability is that the title pEPSS 0.5%CVE-2025-32650HIGHWordPress Accessibility Suite by Ability, Inc plugin <= 4.18 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-56247HIGHWordPress WP Post Author plugin <= 3.8.2 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-32567HIGHWordPress Easy Post Duplicator Plugin <= 1.0.1 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-32558HIGHWordPress Duplicate Title Checker Plugin <= 1.2 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-47328HIGHWordPress Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin <= 3.1.2 - SQL Injection vulnerabilityEPSS 0.5%