Weaknesses of type CWE-89

13,149 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2024-10447MEDIUMProject Worlds Online Time Table Generator staffdashboard.php sql injectionEPSS 0.5%CVE-2023-7191MEDIUMS-CMS reg.php sql injectionEPSS 0.5%CVE-2026-41422HIGHDaptin vulnerable to SQL injection via unvalidated goqu.L() calls in aggregate APIEPSS 0.5%CVE-2022-47420MEDIUMWordPress Accessibility Suite by Online ADA Plugin <= 4.12 is vulnerable to SQL InjectionEPSS 0.5%CVE-2025-40713CRITICALSQL injection vulnerability in Quiter GatewayEPSS 0.5%CVE-2026-81674CRITICALMultiple Vulnerabilities in TOOOLS' iSquadEPSS 0.5%CVE-2025-15243MEDIUMcode-projects Simple Stock System login.php sql injectionEPSS 0.5%CVE-2023-7186MEDIUM7-card Fakabao notify.php sql injectionEPSS 0.5%CVE-2024-11837HIGHN1QL InjectionEPSS 0.5%CVE-2024-12941MEDIUMCodeAstro Blood Donor Management System deletedannounce.php sql injectionEPSS 0.5%CVE-2025-10836MEDIUMSourceCodester Pet Grooming Management Software print1.php sql injectionEPSS 0.5%CVE-2025-10030MEDIUMCampcodes Grocery Sales and Inventory System ajax.php sql injectionEPSS 0.5%CVE-2025-11064MEDIUMCampcodes Online Learning Management System teachers.php sql injectionEPSS 0.5%CVE-2025-11061MEDIUMCampcodes Online Learning Management System edit_student.php sql injectionEPSS 0.5%CVE-2025-11063MEDIUMCampcodes Online Learning Management System edit_department.php sql injectionEPSS 0.5%CVE-2025-10445MEDIUMCampcodes Computer Sales and Inventory System us_transac.php sql injectionEPSS 0.5%CVE-2025-11662MEDIUMSourceCodester Best Salon Management System booking.php sql injectionEPSS 0.5%CVE-2025-10832MEDIUMSourceCodester Pet Grooming Management Software fetch_product_details.php sql injectionEPSS 0.5%CVE-2025-11558MEDIUMcode-projects E-Commerce Website user_index_search.php sql injectionEPSS 0.5%CVE-2025-5493MEDIUMBaison Channel Middleware Product ToJsonByControlName sql injectionEPSS 0.5%