Weaknesses of type CWE-89

13,618 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2016-10550—sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server iEPSS 1.9%CVE-2023-0961MEDIUMSourceCodester Music Gallery Site GET Request view_music_details.php sql injectionEPSS 1.9%CVE-2026-41640HIGHNocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager LoadingEPSS 1.9%CVE-2021-43863HIGHSQL Injection in FileContentProvider (GHSL-2021-1007)EPSS 1.9%CVE-2019-1825HIGHCisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection VulnerabilitiesEPSS 1.9%CVE-2019-1824HIGHCisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection VulnerabilitiesEPSS 1.9%CVE-2026-3326HIGHXStore < 9.7.3 - Unauthenticated SQLiEPSS 1.9%CVE-2021-36916HIGHWordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerabilityEPSS 1.9%CVE-2021-41147HIGHSQL injection in the planning edition panelEPSS 1.9%CVE-2024-3217HIGHWP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL InjectionEPSS 1.9%CVE-2022-0694—Advanced Booking Calendar < 1.7.0 - Unauthenticated SQL InjectionEPSS 1.8%CVE-2024-6813HIGHNETGEAR ProSAFE Network Management System getSortString SQL Injection Remote Code Execution VulnerabilityEPSS 1.8%CVE-2023-39357HIGHA Defect in sql_save() Causes Multiple SQL Injection Vulnerabilities in CactiEPSS 1.8%CVE-2020-6009—LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.EPSS 1.8%CVE-2025-22953CRITICALA SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.57EPSS 1.8%CVE-2026-41641HIGHNocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` CallEPSS 1.8%CVE-2021-24361—GeoDirectory Location Manager < 2.1.0.10 - Multiple Unauthenticated SQL InjectionsEPSS 1.8%CVE-2020-36195CRITICALSQL Injection Vulnerability in Multimedia Console and the Media Streaming Add-OnEPSS 1.8%CVE-2025-41403HIGHSQL InjectionEPSS 1.8%CVE-2026-42031HIGHCKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`EPSS 1.8%