Weaknesses of type CWE-89

13,618 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2022-3494HIGHComplianz (Free < 6.3.4, Premium < 6.3.6) - Translator SQLiEPSS 1.6%CVE-2025-5569MEDIUMIdeaCMS getList.html Goods sql injectionEPSS 1.6%CVE-2026-69084CRITICALSiYuan before v3.7.3 SQL Injection via searchEmbedBlockEPSS 1.6%CVE-2024-50672CRITICALA NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to reset user and administEPSS 1.6%CVE-2021-24391—Cashtomer <= 1.0.0 - Authenticated SQL InjectionEPSS 1.6%CVE-2021-24520—Stock in & out <= 1.0.4 - Authenticated SQL InjectionEPSS 1.6%CVE-2021-24337—Video Embed <= 1.0 - Authenticated (subscriber+) SQL InjectionEPSS 1.6%CVE-2021-24631—Unlimited PopUps <= 4.5.3 - Author+ SQL InjectionEPSS 1.6%CVE-2021-24630—Schreikasten <= 0.14.18 - Author+ SQL InjectionsEPSS 1.6%CVE-2021-24726—WP Simple Booking Calendar <= 2.0.6 (before 07/12/2021) - Authenticated SQL InjectionEPSS 1.6%CVE-2023-45657HIGHWordPress Nexter Theme <= 2.0.3 is vulnerable to SQL InjectionEPSS 1.6%CVE-2024-35182MEDIUMGHSL-2024-014 Meshery SQL Injection vulnerabilityEPSS 1.6%CVE-2022-42744CRITICALCandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the apEPSS 1.6%CVE-2021-24348—Side Menu < 3.1.5 - Authenticated (admin+) SQL InjectionEPSS 1.6%CVE-2021-24772—Stream < 3.8.2 - Admin+ SQL InjectionEPSS 1.6%CVE-2024-25897CRITICALChurchCRM 5.5.0 FRCatalog.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter.EPSS 1.6%CVE-2022-1683—amtyThumb <= 4.2.0 - Subscriber+ SQLiEPSS 1.5%CVE-2021-24390—Alipay <= 3.7.2 - Authenticated SQL InjectionEPSS 1.5%CVE-2021-24395—Embed Youtube Video <= 1.0 - Authenticated SQL InjectionEPSS 1.5%CVE-2021-24392—WordPress Membership SwiftCloud.io <= 1.0 - Authenticated SQL InjectionEPSS 1.5%