Weaknesses of type CWE-89

13,618 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2021-24336—FlightLog <= 3.0.2 - Authenticated (editor+) SQL InjectionEPSS 1.5%CVE-2021-24395—Embed Youtube Video <= 1.0 - Authenticated SQL InjectionEPSS 1.5%CVE-2021-24392—WordPress Membership SwiftCloud.io <= 1.0 - Authenticated SQL InjectionEPSS 1.5%CVE-2021-24390—Alipay <= 3.7.2 - Authenticated SQL InjectionEPSS 1.5%CVE-2021-24629—Post Content XMLRPC <= 1.0 - Admin+ SQL InjectionsEPSS 1.5%CVE-2021-24747—SEO Booster < 3.8 - Admin+ SQL InjectionEPSS 1.5%CVE-2021-24753—Rich Reviews by Starfish < 1.9.6 - Admin+ SQL InjectionEPSS 1.5%CVE-2021-24628—Wow Forms <= 3.1.3 - Admin+ SQL InjectionEPSS 1.5%CVE-2018-7528—An SQL injection vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP caEPSS 1.5%CVE-2024-32838CRITICALApache Fineract: SQL injection vulnerabilities in offices API endpointEPSS 1.5%CVE-2019-10916—A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.EPSS 1.5%CVE-2022-37208HIGHJFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses itsEPSS 1.5%CVE-2023-35188HIGHSQL Injection Remote Code Execution VulnerabilityEPSS 1.5%CVE-2022-0478—Event Manager for WooCommerce < 3.5.8 - Contributor+ SQL InjectionEPSS 1.5%CVE-2020-35012—Events Manager < 5.9.8 - Admin+ SQL InjectionEPSS 1.5%CVE-2021-24844—Affiliate Manager < 2.8.7 - Admin+ SQL injectionEPSS 1.5%CVE-2021-24511—Create WooCommerce Product Feeds For 40+ Merchants < 3.3.1.0 - Authenticated SQL InjectionEPSS 1.5%CVE-2025-41407HIGHSQL InjectionEPSS 1.5%CVE-2020-12014—Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Input is not properly sanitized and may allow an attacker to inject SQL coEPSS 1.5%CVE-2021-41148HIGHThe update of the CI job targeted by a widget is vulnerable to blind SQL injectionsEPSS 1.5%