Weaknesses of type CWE-89

13,203 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2025-5176MEDIUMRealce Tecnologia Queue Ticket Kiosk Admin Login Page index.php sql injectionEPSS 0.5%CVE-2025-12261MEDIUMCodeAstro Gym Management System remove-announcement.php sql injectionEPSS 0.5%CVE-2026-16087MEDIUMIcegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' ParameterEPSS 0.5%CVE-2025-7138MEDIUMSourceCodester Best Salon Management System admin-profile.php sql injectionEPSS 0.5%CVE-2026-16961HIGHIBM i is Affected By SQL Injection Vulnerability in Db2 Mirror []EPSS 0.5%CVE-2026-41490HIGHDagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager IntegrationsEPSS 0.5%CVE-2026-15281MEDIUMUser Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL InjectionEPSS 0.5%CVE-2025-6876MEDIUMSourceCodester Best Salon Management System add-category.php sql injectionEPSS 0.5%CVE-2025-14711MEDIUMFantasticLBP Hotels Server hotelList.php sql injectionEPSS 0.5%CVE-2024-7101MEDIUMForIP Tecnologia Administração PABX Authentication Form login sql injectionEPSS 0.5%CVE-2025-25151HIGHWordPress uListing Plugin <= 2.1.6 - SQL Injection vulnerabilityEPSS 0.5%CVE-2026-4608MEDIUMProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' ParameterEPSS 0.5%CVE-2025-50972CRITICALSQL Injection vulnerability in AbanteCart 1.4.2, allows unauthenticated attackers to execute arbitrary SQL commands via the tmpl_id parameteEPSS 0.5%CVE-2025-6877MEDIUMSourceCodester Best Salon Management System edit-category.php sql injectionEPSS 0.5%CVE-2025-7137MEDIUMSourceCodester Best Salon Management System schedule-staff.php sql injectionEPSS 0.5%CVE-2024-7857MEDIUMMedia Library Folders <= 8.2.2 - Authenticated (Subscriber+) Second-Order SQL InjectionEPSS 0.5%CVE-2025-64519HIGHTorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameterEPSS 0.5%CVE-2025-47573CRITICALWordPress School Management System Plugin <= 92.0.0 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-6861MEDIUMSourceCodester Best Salon Management System add_plan.php sql injectionEPSS 0.5%CVE-2026-13454MEDIUMMotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' ParameterEPSS 0.5%