Weaknesses of type CWE-89

11,923 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2019-25495HIGHosCommerce 2.3.4.1 SQL Injection via reviews_id ParameterEPSS 0.3%CVE-2019-25684HIGHOpenDocMan 1.3.4 SQL Injection via where ParameterEPSS 0.3%CVE-2018-25209HIGHOpenBiz Cubi Lite 3.0.8 SQL Injection via username ParameterEPSS 0.3%CVE-2026-32127HIGHSQL Injection Vulnerability in ajax graphs library (OpenEMR)EPSS 0.3%CVE-2025-4381HIGHAds Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated SQL InjectionEPSS 0.3%CVE-2019-25497HIGHosCommerce 2.3.4.1 SQL Injection via currency ParameterEPSS 0.3%CVE-2019-25635HIGHZeeways Matrimony CMS Lastest SQL Injection via profile_listEPSS 0.3%CVE-2025-5339HIGHAds Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Time-Based SQL Injection via ‘bsa_pro_id'EPSS 0.3%CVE-2026-1478CRITICALOut-of-band SQL injection in Quatuor Performance EvaluationEPSS 0.3%CVE-2024-13778MEDIUMHero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Authenticated (Subscriber+) SQL InjectionEPSS 0.3%CVE-2026-1483CRITICALOut-of-band SQL injection in Quatuor Performance EvaluationEPSS 0.3%CVE-2026-1474CRITICALOut-of-band SQL injection in Quatuor Performance EvaluationEPSS 0.3%CVE-2026-4469MEDIUMitsourcecode Online Frozen Foods Ordering System admin_edit_menu_action.php sql injectionEPSS 0.3%CVE-2026-1482CRITICALOut-of-band SQL injection in Quatuor Performance EvaluationEPSS 0.3%CVE-2026-1479CRITICALOut-of-band SQL injection in Quatuor Performance EvaluationEPSS 0.3%CVE-2026-4661HIGHWP CTA <= 2.2.2 - Unauthenticated Time-Based Blind SQL Injection via 'fildname' ParameterEPSS 0.3%CVE-2019-25496HIGHosCommerce 2.3.4.1 SQL Injection via products_id ParameterEPSS 0.3%CVE-2026-1480CRITICALOut-of-band SQL injection in Quatuor Performance EvaluationEPSS 0.3%CVE-2025-6437HIGHAds Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated SQL Injection via oidEPSS 0.3%CVE-2026-4470MEDIUMitsourcecode Online Frozen Foods Ordering System admin_edit_menu.php sql injectionEPSS 0.3%