Weaknesses of type CWE-89

11,911 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2025-6724HIGHChef Automate SQL Injection VulnerabilityEPSS 0.3%CVE-2026-57588LOWSQL Injection in Nessus via Malicious Scan Result File ImportEPSS 0.3%CVE-2026-40900HIGHDataEase has SQL Injection via Stacked QueriesEPSS 0.3%CVE-2025-4780MEDIUMPHPGurukul Park Ticketing Management System foreigner-search.php sql injectionEPSS 0.3%CVE-2025-25462MEDIUMA SQL Injection vulnerability was found in /admin/add-propertytype.php in PHPGurukul Land Record System Project in PHP v1.0 allows remote atEPSS 0.3%CVE-2025-69135HIGHWordPress Events Schedule - WordPress Events Calendar Plugin plugin <= 2.7.2 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-21875CRITICALClipBucket v5 Vulnerable to Blind SQL Injection through Channel CommentsEPSS 0.3%CVE-2025-14068HIGHWPNakama <= 0.6.3 - Unauthenticated SQL Injection via 'order_by' ParameterEPSS 0.3%CVE-2026-5033MEDIUMcode-projects Accounting System Parameter view_costumer.php sql injectionEPSS 0.3%CVE-2025-5368MEDIUMPHPGurukul Daily Expense Tracker System expense-yearwise-reports-detailed.php sql injectionEPSS 0.3%CVE-2025-5761MEDIUMPHPGurukul BP Monitoring Management System edit-family-member.php sql injectionEPSS 0.3%CVE-2026-42229MEDIUMn8n: SQL Injection in SeaTable NodeEPSS 0.3%CVE-2026-41143HIGHYesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()EPSS 0.3%CVE-2019-25703HIGHImpressCMS 1.3.11 SQL Injection via bid ParameterEPSS 0.3%CVE-2019-25663HIGHSuiteCRM 7.10.7 SQL Injection via parentTab ParameterEPSS 0.3%CVE-2025-6156MEDIUMPHPGurukul Nipah Virus Testing Management System bwdates-report-ds.php sql injectionEPSS 0.3%CVE-2019-25573HIGHGreen CMS 2.x SQL Injection via cat ParameterEPSS 0.3%CVE-2019-25335HIGHPRO-7070 Hazır Profesyonel Web Sitesi 1.0 - Authentication BypassEPSS 0.3%CVE-2019-25664HIGHSuiteCRM 7.10.7 SQL Injection via record ParameterEPSS 0.3%CVE-2025-10047MEDIUMEmail Tracker <= 5.3.15 - Authenticated (Admin+) SQL InjectionEPSS 0.3%