Weaknesses of type CWE-89

13,130 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2023-1735MEDIUMSourceCodester Young Entrepreneur E-Negosyo System passwordrecover.php sql injectionEPSS 0.5%CVE-2023-3850MEDIUMSourceCodester Lost and Found Information System HTTP POST Request sql injectionEPSS 0.5%CVE-2023-3793MEDIUMWeaver e-cology HTTP POST Request filelFileDownloadForOutDoc.class sql injectionEPSS 0.5%CVE-2026-3754MEDIUMSourceCodester Sales and Inventory System add_stock.php sql injectionEPSS 0.5%CVE-2026-3755MEDIUMSourceCodester Sales and Inventory System POST check_customer_details.php sql injectionEPSS 0.5%CVE-2026-3790MEDIUMSourceCodester Sales and Inventory System POST Parameter check_supplier_details.php sql injectionEPSS 0.5%CVE-2025-4163MEDIUMPHPGurukul Land Record System aboutus.php sql injectionEPSS 0.5%CVE-2026-3753MEDIUMSourceCodester Sales and Inventory System add_sales_print.php sql injectionEPSS 0.5%CVE-2025-49468HIGHJoomla Extension - nobossextensions.com - SQL injection vulnerability in No Boss Calendar component before 5.0.7 for JoomlaEPSS 0.5%CVE-2026-3792MEDIUMSourceCodester Sales and Inventory System GET Parameter purchase_invoice.php sql injectionEPSS 0.5%CVE-2026-3793MEDIUMSourceCodester Sales and Inventory System GET Parameter sales_invoice1.php sql injectionEPSS 0.5%CVE-2026-3771MEDIUMSourceCodester/janobe Resort Reservation System accomodation.php sql injectionEPSS 0.5%CVE-2026-75132HIGHWAPT Server SQL Injection via /api/v3/hosts EndpointEPSS 0.5%CVE-2026-3791MEDIUMSourceCodester Sales and Inventory System Search dashboard.php sql injectionEPSS 0.5%CVE-2026-3806MEDIUMSourceCodester/janobe Resort Reservation System room_rates.php sql injectionEPSS 0.5%CVE-2023-1566MEDIUMSourceCodester Medical Certificate Generator App action.php sql injectionEPSS 0.5%CVE-2026-3756MEDIUMSourceCodester Sales and Inventory System check_item_details.php sql injectionEPSS 0.5%CVE-2024-12615MEDIUMPasswords Manager <= 1.4.8 - Authenticated (Subscriber+) SQL InjectionEPSS 0.5%CVE-2024-4925MEDIUMSourceCodester School Intramurals Student Attendance Management System manage_course.php sql injectionEPSS 0.5%CVE-2024-4926MEDIUMSourceCodester School Intramurals Student Attendance Management System manage_student.php sql injectionEPSS 0.5%