Weaknesses of type CWE-89

12,845 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2022-35864MEDIUMThis vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It! 20.21.02.109. AuthenEPSS 1.6%CVE-2021-24726—WP Simple Booking Calendar <= 2.0.6 (before 07/12/2021) - Authenticated SQL InjectionEPSS 1.6%CVE-2021-24631—Unlimited PopUps <= 4.5.3 - Author+ SQL InjectionEPSS 1.6%CVE-2021-24348—Side Menu < 3.1.5 - Authenticated (admin+) SQL InjectionEPSS 1.6%CVE-2024-35182MEDIUMGHSL-2024-014 Meshery SQL Injection vulnerabilityEPSS 1.6%CVE-2021-24772—Stream < 3.8.2 - Admin+ SQL InjectionEPSS 1.6%CVE-2024-25897CRITICALChurchCRM 5.5.0 FRCatalog.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter.EPSS 1.6%CVE-2022-37205HIGHJFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its EPSS 1.6%CVE-2021-24393—Comment Highlighter <= 0.13 - Authenticated SQL InjectionEPSS 1.5%CVE-2021-24392—WordPress Membership SwiftCloud.io <= 1.0 - Authenticated SQL InjectionEPSS 1.5%CVE-2021-24390—Alipay <= 3.7.2 - Authenticated SQL InjectionEPSS 1.5%CVE-2021-24336—FlightLog <= 3.0.2 - Authenticated (editor+) SQL InjectionEPSS 1.5%CVE-2021-24395—Embed Youtube Video <= 1.0 - Authenticated SQL InjectionEPSS 1.5%CVE-2021-24557—M-vSlider <= 2.1.3 - Authenticated (admin+) SQL InjectionEPSS 1.5%CVE-2021-24394—Easy Testimonial Manager <= 1.2.0 - Authenticated SQL InjectionEPSS 1.5%CVE-2021-24629—Post Content XMLRPC <= 1.0 - Admin+ SQL InjectionsEPSS 1.5%CVE-2021-24628—Wow Forms <= 3.1.3 - Admin+ SQL InjectionEPSS 1.5%CVE-2021-43806HIGHSQL injection in TuleapEPSS 1.5%CVE-2018-7528—An SQL injection vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP caEPSS 1.5%CVE-2024-32838CRITICALApache Fineract: SQL injection vulnerabilities in offices API endpointEPSS 1.5%