Weaknesses of type CWE-89

13,617 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2022-30004CRITICALSourcecodester Online Market Place Site v1.0 suffers from an unauthenticated blind SQL Injection Vulnerability allowing remote attackers to EPSS 1.9%CVE-2026-49772CRITICALWordPress The Events Calendar plugin 6.15.12-6.16.2 - SQL Injection vulnerabilityEPSS 1.9%CVE-2025-9744MEDIUMCampcodes Online Loan Management System ajax.php sql injectionEPSS 1.9%CVE-2025-10090MEDIUMJinher OA GetTreeDate.aspx sql injectionEPSS 1.9%CVE-2021-29089CRITICALImproper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo EPSS 1.9%CVE-2024-6043MEDIUMSourceCodester Best House Rental Management System admin_class.php login sql injectionEPSS 1.9%CVE-2021-1247HIGHCisco Data Center Network Manager SQL Injection VulnerabilitiesEPSS 1.9%CVE-2021-39179HIGHSQL Injection in DHIS2 Tracker APIEPSS 1.9%CVE-2022-2067HIGHSQL Injection in francoisjacquet/rosariosisEPSS 1.9%CVE-2024-31820CRITICALAn issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitraryEPSS 1.9%CVE-2021-24551—Edit Comments <= 0.3 - Unauthenticated SQL InjectionEPSS 1.9%CVE-2021-1248HIGHCisco Data Center Network Manager SQL Injection VulnerabilitiesEPSS 1.9%CVE-2022-1505CRITICALRSVPMaker <= 9.2.6 - Unauthenticated SQL InjectionEPSS 1.9%CVE-2021-23214—When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle aEPSS 1.9%CVE-2025-2010HIGHJobWP – Job Board, Job Listing, Career Page and Recruitment Plugin <= 2.3.9 - Unauthenticated SQL InjectionEPSS 1.9%CVE-2025-9977MEDIUMImproper neutralization of input in Times Software E-PAYROLLEPSS 1.9%CVE-2021-24221—Quiz And Survey Master < 7.1.12 - Authenticated SQL injection via shortcodeEPSS 1.9%CVE-2019-18234—Equinox Control Expert all versions, is vulnerable to an SQL injection attack, which may allow an attacker to remotely execute arbitrary codEPSS 1.9%CVE-2023-5412HIGHImage horizontal reel scroll slideshow <= 13.2 - Authenticated (Subscriber+) SQL Injection via ShortcodeEPSS 1.9%CVE-2016-10554—sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server iEPSS 1.9%