Weaknesses of type CWE-89

12,839 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2021-39179HIGHSQL Injection in DHIS2 Tracker APIEPSS 1.9%CVE-2024-31820CRITICALAn issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitraryEPSS 1.9%CVE-2016-10554—sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server iEPSS 1.9%CVE-2016-10550—sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server iEPSS 1.9%CVE-2021-24551—Edit Comments <= 0.3 - Unauthenticated SQL InjectionEPSS 1.9%CVE-2023-5350MEDIUMSQL Injection in salesagility/suitecrmEPSS 1.9%CVE-2026-46670CRITICALYesWiki: Unauthenticated SQL InjectionEPSS 1.9%CVE-2020-7500—A CWE-89:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in U.motion Servers and TEPSS 1.9%CVE-2021-1247HIGHCisco Data Center Network Manager SQL Injection VulnerabilitiesEPSS 1.9%CVE-2021-23214—When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle aEPSS 1.9%CVE-2022-30004CRITICALSourcecodester Online Market Place Site v1.0 suffers from an unauthenticated blind SQL Injection Vulnerability allowing remote attackers to EPSS 1.9%CVE-2021-24221—Quiz And Survey Master < 7.1.12 - Authenticated SQL injection via shortcodeEPSS 1.9%CVE-2022-2067HIGHSQL Injection in francoisjacquet/rosariosisEPSS 1.9%CVE-2019-18234—Equinox Control Expert all versions, is vulnerable to an SQL injection attack, which may allow an attacker to remotely execute arbitrary codEPSS 1.9%CVE-2021-1248HIGHCisco Data Center Network Manager SQL Injection VulnerabilitiesEPSS 1.9%CVE-2023-0961MEDIUMSourceCodester Music Gallery Site GET Request view_music_details.php sql injectionEPSS 1.9%CVE-2022-1505CRITICALRSVPMaker <= 9.2.6 - Unauthenticated SQL InjectionEPSS 1.9%CVE-2026-41640HIGHNocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager LoadingEPSS 1.9%CVE-2021-43863HIGHSQL Injection in FileContentProvider (GHSL-2021-1007)EPSS 1.9%CVE-2023-45826MEDIUMAuthenticated SQL Injection in leantimeEPSS 1.9%