Weaknesses of type CWE-89

12,845 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2021-24341—Xllentech English Islamic Calendar < 2.6.8 - Authenticated SQL InjectionEPSS 1.6%CVE-2026-8054CRITICALUnauthenticated SQL Injection in dotCMS Publish Audit APIEPSS 1.6%CVE-2020-26075MEDIUMCisco IoT Field Network REST API Insufficient Input Validation VulnerabilityEPSS 1.6%CVE-2022-1014—WP Contacts Manager <= 2.2.4 - Unauthenticated SQLiEPSS 1.6%CVE-2026-11840HIGHSQL InjectionEPSS 1.6%CVE-2021-22854HIGHSoar Cloud System Co., Ltd. HR Portal - SQL InjectionEPSS 1.6%CVE-2021-24553—Timeline Calendar <= 1.2 - Authenticated (admin+) SQL InjectionEPSS 1.6%CVE-2021-24550—Broken Link Manager <= 0.6.5 - Authenticated (admin+) SQL InjectionEPSS 1.6%CVE-2021-24552—Simple Events Calendar <= 1.4.0 - Authenticated (admin+) SQL InjectionEPSS 1.6%CVE-2023-50395HIGHSQL Injection Remote Code Execution VulnerabilityEPSS 1.6%CVE-2026-6854HIGHMy Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' ParametersEPSS 1.6%CVE-2020-13566HIGHSQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an EPSS 1.6%CVE-2021-24866—WP Data Access < 5.0.0 - Admin+ SQL InjectionEPSS 1.6%CVE-2021-24863—StopBadBots < 6.67 - Unauthenticated SQL InjectionEPSS 1.6%CVE-2021-24951—LearnPress < 4.1.4 - Admin+ SQL InjectionEPSS 1.6%CVE-2024-50672CRITICALA NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to reset user and administEPSS 1.6%CVE-2021-24337—Video Embed <= 1.0 - Authenticated (subscriber+) SQL InjectionEPSS 1.6%CVE-2021-24391—Cashtomer <= 1.0.0 - Authenticated SQL InjectionEPSS 1.6%CVE-2021-24520—Stock in & out <= 1.0.4 - Authenticated SQL InjectionEPSS 1.6%CVE-2021-24631—Unlimited PopUps <= 4.5.3 - Author+ SQL InjectionEPSS 1.6%