Weaknesses of type CWE-89

13,194 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2025-2374MEDIUMPHPGurukul Human Metapneumovirus Testing Management System profile.php sql injectionEPSS 0.5%CVE-2024-2386HIGHWordPress Plugin for Google Maps – WP MAPS <= 4.6.1 - Authenticated (Contributor+) SQL InjectionEPSS 0.5%CVE-2025-2373MEDIUMPHPGurukul Human Metapneumovirus Testing Management System check_availability.php sql injectionEPSS 0.5%CVE-2025-24669HIGHWordPress SERPed.net Plugin <= 4.4 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-70152CRITICALcode-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/saEPSS 0.5%CVE-2025-2051MEDIUMPHPGurukul Apartment Visitors Management System search-visitor.php sql injectionEPSS 0.5%CVE-2025-6495HIGHBricks Builder <= 1.12.4 - Unauthenticated SQL Injection via `p` ParameterEPSS 0.5%CVE-2024-33968CRITICALSQL injection in Janobe productsEPSS 0.5%CVE-2025-3955MEDIUMcodeprojects Patient Record Management System edit_rpatient.php.php sql injectionEPSS 0.5%CVE-2024-33962CRITICALSQL injection in Janobe productsEPSS 0.5%CVE-2024-33964CRITICALSQL injection in Janobe productsEPSS 0.5%CVE-2025-8467MEDIUMcode-projects Wazifa System regcontrol.php sql injectionEPSS 0.5%CVE-2025-7606MEDIUMcode-projects AVL Rooms city.php sql injectionEPSS 0.5%CVE-2024-33966CRITICALSQL injection in Janobe productsEPSS 0.5%CVE-2025-7609MEDIUMcode-projects Simple Shopping Cart register.php sql injectionEPSS 0.5%CVE-2025-7436MEDIUMCampcodes Online Recruitment Management System ajax.php sql injectionEPSS 0.5%CVE-2025-7466MEDIUM1000projects ABC Courier Management add_dealerrequest.php sql injectionEPSS 0.5%CVE-2025-7454MEDIUMCampcodes Online Movie Theater Seat Reservation System manage_theater.php sql injectionEPSS 0.5%CVE-2025-7483MEDIUMPHPGurukul Vehicle Parking Management System forgot-password.php sql injectionEPSS 0.5%CVE-2025-2107HIGHArielbrailovsky-Viralad <= 1.0.8 - Unauthenticated SQL InjectionEPSS 0.5%