Weaknesses of type CWE-89

13,130 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2025-10618MEDIUMitsourcecode Online Clinic Management System transact.php sql injectionEPSS 0.5%CVE-2025-15268HIGHInfility Global <= 2.14.46 - Unauthenticated SQL Injection via Predictable API Key and IP Whitelist BypassEPSS 0.5%CVE-2024-5543HIGHSlideshow Gallery LITE <= 1.8.1 - Authenticated (Contributor+) SQL InjectionEPSS 0.5%CVE-2024-45600HIGHFields GLPI plugin has an Authenticated SQL InjectionEPSS 0.5%CVE-2025-56421HIGHSQL Injection vulnerability in LimeSurvey before v.6.15.4+250710 allows a remote attacker to obtain sensitive information from the database.EPSS 0.5%CVE-2025-25206HIGHIncorrect input validation could allow an authenticated user to read sensitive informationEPSS 0.5%CVE-2025-9413MEDIUMlostvip-com ruoyi-go system_router.go SelectListByPage sql injectionEPSS 0.5%CVE-2024-50479CRITICALWordPress Woocommerce Quote Calculator plugin <= 1.1 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-56041HIGHWordPress VibeBP plugin < 1.9.9.5.1 - SQL Injection vulnerabilityEPSS 0.5%CVE-2026-1105MEDIUMEasyCMS UserAction.class.php sql injectionEPSS 0.5%CVE-2025-6480MEDIUMcode-projects Simple Pizza Ordering System addcatexec.php sql injectionEPSS 0.5%CVE-2024-24375HIGHSQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter.EPSS 0.5%CVE-2024-34989CRITICALIn the module RSI PDF/HTML catalog evolution (prestapdf) <= 7.0.0 from RSI for PrestaShop, a guest can perform SQL injection via `PrestaPDFPEPSS 0.5%CVE-2025-5403MEDIUMchaitak-gorai Blogbook GET Parameter view_all_posts.php sql injectionEPSS 0.5%CVE-2026-18782CRITICALSQL Injection in Trex Digital Manufacturing's Trex MESEPSS 0.5%CVE-2025-0231MEDIUMCodezips Gym Management System submit_payments.php sql injectionEPSS 0.5%CVE-2024-5098MEDIUMSourceCodester Simple Inventory System login.php sql injectionEPSS 0.5%CVE-2024-7934MEDIUMitsourcecode Project Expense Monitoring System execute.php sql injectionEPSS 0.5%CVE-2024-5325HIGHForm Vibes <= 1.4.10 - Authenticated (Subscriber+) SQL Injection via fv_export_dataEPSS 0.5%CVE-2025-0334MEDIUMleiyuxi cy-fast listData sql injectionEPSS 0.5%