Weaknesses of type CWE-89

13,618 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2021-43806HIGHSQL injection in TuleapEPSS 1.6%CVE-2023-26034CRITICALZoneMinder SQL InjectionEPSS 1.6%CVE-2025-47954HIGHMicrosoft SQL Server Elevation of Privilege VulnerabilityEPSS 1.6%CVE-2026-12741HIGHWP Fast Total Search <= 1.80.280 - Unauthenticated SQL InjectionEPSS 1.6%CVE-2026-12800HIGHPremium Packages <= 6.2.0 - Unauthenticated SQL InjectionEPSS 1.6%CVE-2022-37205HIGHJFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its EPSS 1.6%CVE-2021-24521—Side Menu Lite < 2.2.1 - Authenticated SQL InjectionEPSS 1.6%CVE-2014-5399—Schneider Electric Wonderware SQL InjectionEPSS 1.6%CVE-2021-24341—Xllentech English Islamic Calendar < 2.6.8 - Authenticated SQL InjectionEPSS 1.6%CVE-2018-7501—In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prioEPSS 1.6%CVE-2022-37209HIGHJFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its EPSS 1.6%CVE-2026-8054CRITICALUnauthenticated SQL Injection in dotCMS Publish Audit APIEPSS 1.6%CVE-2020-26075MEDIUMCisco IoT Field Network REST API Insufficient Input Validation VulnerabilityEPSS 1.6%CVE-2021-22854HIGHSoar Cloud System Co., Ltd. HR Portal - SQL InjectionEPSS 1.6%CVE-2021-24550—Broken Link Manager <= 0.6.5 - Authenticated (admin+) SQL InjectionEPSS 1.6%CVE-2023-50395HIGHSQL Injection Remote Code Execution VulnerabilityEPSS 1.6%CVE-2021-24553—Timeline Calendar <= 1.2 - Authenticated (admin+) SQL InjectionEPSS 1.6%CVE-2021-24552—Simple Events Calendar <= 1.4.0 - Authenticated (admin+) SQL InjectionEPSS 1.6%CVE-2026-6854HIGHMy Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' ParametersEPSS 1.6%CVE-2022-3494HIGHComplianz (Free < 6.3.4, Premium < 6.3.6) - Translator SQLiEPSS 1.6%