Weaknesses of type CWE-89

13,202 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2024-13532HIGHSmall Package Quotes – Purolator Edition <= 3.6.4 - Unauthenticated SQL InjectionEPSS 0.5%CVE-2026-12987HIGHEvents Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking RegistrationEPSS 0.5%CVE-2025-6412MEDIUMPHPGurukul Art Gallery Management System changeimage.php sql injectionEPSS 0.5%CVE-2025-5431MEDIUMAssamLook CMS department-profile.php sql injectionEPSS 0.5%CVE-2025-6606MEDIUMSourceCodester Best Salon Management System add-services.php sql injectionEPSS 0.5%CVE-2026-35222MEDIUMJoomla! Core - [20260507] - Authenticated blind SQLi in com_tagsEPSS 0.5%CVE-2025-6607MEDIUMSourceCodester Best Salon Management System stock.php sql injectionEPSS 0.5%CVE-2025-40715CRITICALSQL injection vulnerability in Quiter GatewayEPSS 0.5%CVE-2025-40716CRITICALSQL injection vulnerability in Quiter GatewayEPSS 0.5%CVE-2024-47487HIGHThere is a SQL injection vulnerability in some HikCentral Professional versions. This could allow an authenticated user to execute arbitraryEPSS 0.5%CVE-2025-6570MEDIUMPHPGurukul Hospital Management System search.php sql injectionEPSS 0.5%CVE-2025-6608MEDIUMSourceCodester Best Salon Management System edit-services.php sql injectionEPSS 0.5%CVE-2026-73408HIGHBudibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database ConnectorEPSS 0.5%CVE-2025-6414MEDIUMPHPGurukul Art Gallery Management System changeimage2.php sql injectionEPSS 0.5%CVE-2025-6410MEDIUMPHPGurukul Art Gallery Management System edit-art-medium-detail.php sql injectionEPSS 0.5%CVE-2025-0176MEDIUMcode-projects Point of Sales and Inventory Management System add_cart.php sql injectionEPSS 0.5%CVE-2025-40717CRITICALSQL injection vulnerability in Quiter GatewayEPSS 0.5%CVE-2025-31024HIGHWordPress RJ Quickcharts plugin <= 0.6.1 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-29730CRITICALMultiple vulnerabilities in SportsNETEPSS 0.5%CVE-2024-7702HIGHContact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection via getLogHistory FunctionEPSS 0.5%