Weaknesses of type CWE-89

13,151 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2025-9770MEDIUMCampcodes Hospital Management System Admin Dashboard Login admin sql injectionEPSS 0.5%CVE-2025-63452CRITICALCar-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/forgot-pass.php.EPSS 0.5%CVE-2025-6277MEDIUMBrilliance Golden Link Secondary System custTakeInfoPage.htm sql injectionEPSS 0.5%CVE-2025-2738MEDIUMPHPGurukul Old Age Home Management System manage-scdetails.php sql injectionEPSS 0.5%CVE-2026-4779MEDIUMSourceCodester Sales and Inventory System HTTP GET Parameter update_customer_details.php sql injectionEPSS 0.5%CVE-2026-4780MEDIUMSourceCodester Sales and Inventory System HTTP GET Parameter update_out_standing.php sql injectionEPSS 0.5%CVE-2024-6680MEDIUMwitmy my-springsecurity-plus build sql injectionEPSS 0.5%CVE-2025-26971HIGHWordPress Poll Maker <= 5.6.5 - SQL Injection vulnerabilityEPSS 0.5%CVE-2026-40524HIGHFrontAccounting < 2.4.20 SQL Injection via get_gl_transactions()EPSS 0.5%CVE-2026-4826MEDIUMSourceCodester Sales and Inventory System HTTP GET Parameter update_stock.php sql injectionEPSS 0.5%CVE-2026-4533MEDIUMcode-projects Simple Food Ordering System all-tickets.php sql injectionEPSS 0.5%CVE-2024-53807HIGHWordPress WP Mailster plugin <= 1.8.16.0 - SQL Injection vulnerabilityEPSS 0.5%CVE-2023-0910MEDIUMSourceCodester Online Pizza Ordering System GET Parameter view_prod.php sql injectionEPSS 0.5%CVE-2024-6681MEDIUMwitmy my-springsecurity-plus dept sql injectionEPSS 0.5%CVE-2026-40523HIGHFrontAccounting < 2.4.20 SQL Injection via reporting/rep710.phpEPSS 0.5%CVE-2026-4781MEDIUMSourceCodester Sales and Inventory System HTTP GET Parameter update_purchase.php sql injectionEPSS 0.5%CVE-2025-2737MEDIUMPHPGurukul Old Age Home Management System contactus.php sql injectionEPSS 0.5%CVE-2024-5363MEDIUMSourceCodester Best House Rental Management System manage_user.php sql injectionEPSS 0.5%CVE-2026-4570MEDIUMSourceCodester Sales and Inventory System HTTP POST Request view_customers.php sql injectionEPSS 0.5%CVE-2024-13321HIGHAnalyticsWP <= 2.0.0 - Unauthenticated SQL InjectionEPSS 0.5%