Weaknesses of type CWE-89

13,618 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2020-6128MEDIUMSQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL EPSS 1.8%CVE-2021-41971—Possible SQL Injection when template processing is enabledEPSS 1.8%CVE-2025-47172HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 1.8%CVE-2016-10551—waterline-sequel is a module that helps generate SQL statements for Waterline apps Any user input that goes into Waterline's `like`, `contaiEPSS 1.8%CVE-2026-40887CRITICAL@vendure/core has a SQL Injection vulnerabilityEPSS 1.8%CVE-2021-24949—The Plus Addons for Elementor Pro < 5.0.7 - Unauthenticated SQL InjectionEPSS 1.8%CVE-2020-22452CRITICALSQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_enginEPSS 1.8%CVE-2020-5725—The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint. A remote unauthEPSS 1.8%CVE-2022-45526CRITICALSQL Injection vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows attackers to execute arbitrary commands via tEPSS 1.8%CVE-2024-55982CRITICALWordPress Share Buttons – Social Media plugin <= 1.0.2 - SQL Injection vulnerabilityEPSS 1.8%CVE-2026-21875CRITICALClipBucket v5 Vulnerable to Blind SQL Injection through Channel CommentsEPSS 1.8%CVE-2022-0782—Donations <= 1.8 - Unauthenticated SQLiEPSS 1.7%CVE-2022-0657—5 Stars Rating Funnel < 1.2.53 - Unauthenticated SQLiEPSS 1.7%CVE-2021-24182—Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_answers_by_questionEPSS 1.7%CVE-2021-24183—Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_question_formEPSS 1.7%CVE-2023-0962MEDIUMSourceCodester Music Gallery Site GET Request Master.php sql injectionEPSS 1.7%CVE-2025-2221HIGHWPCOM Member <= 1.7.6 - Unauthenticated Time-Based SQL InjectionEPSS 1.7%CVE-2018-15447MEDIUMCisco Integrated Management Controller Supervisor SQL Injection VulnerabilityEPSS 1.7%CVE-2023-0915MEDIUMSourceCodester Auto Dealer Management System sql injectionEPSS 1.7%CVE-2020-6114MEDIUMAn exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09EPSS 1.7%