Weaknesses of type CWE-89

13,618 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2021-41155HIGHSQL injection in CVS revisions browserEPSS 1.5%CVE-2019-5150HIGHAn exploitable SQL injection vulnerability exist in YouPHPTube 7.7. When the "VideoTags" plugin is enabled, a specially crafted unauthenticaEPSS 1.5%CVE-2021-41154HIGHSQL injection in the "SVN core" commits browserEPSS 1.5%CVE-2025-22461HIGHSQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admiEPSS 1.5%CVE-2021-26636HIGHMaxboard Remote Code ExecutionEPSS 1.5%CVE-2022-2718HIGHJoomSport – for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authenticated (Admin+) SQL Injection via orderbyEPSS 1.5%CVE-2022-2717HIGHJoomSport – for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authentciated (Admin+) SQL Injection via orderbyEPSS 1.5%CVE-2022-36193CRITICALSQL injection in School Management System 1.0 allows remote attackers to modify or delete data, causing persistent changes to the applicatioEPSS 1.5%CVE-2022-0411—Asgaros Forum < 2.0.0 - Subscriber+ Blind SQL InjectionEPSS 1.5%CVE-2021-24399—The Sorter <= 1.0 - Authenticated SQL InjectionEPSS 1.5%CVE-2021-24398—Responsive 3D Slider <= 1.2 - Authenticated SQL InjectionEPSS 1.5%CVE-2021-24403—WordPress Page Contact <= 1.0 - Authenticated (editor+) SQL InjectionEPSS 1.5%CVE-2021-24400—Display users <= 2.0.0 - Authenticated SQL InjectionEPSS 1.5%CVE-2021-24396—GSEOR <= 1.3 - Authenticated SQL InjectionEPSS 1.5%CVE-2021-24625—SpiderCatalog <= 1.7.3 - Admin+ SQL InjectionEPSS 1.5%CVE-2021-24397—MicroCopy <= 1.1.0 - Authenticated SQL InjectionEPSS 1.5%CVE-2020-11004HIGHSQL Injection in AdmidioEPSS 1.5%CVE-2025-54726CRITICALWordPress JS Archive List Plugin < 6.1.6 - SQL Injection VulnerabilityEPSS 1.5%CVE-2022-40944CRITICALDairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via sales-report-ds.php file.EPSS 1.5%CVE-2017-17919HIGHSQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commanEPSS 1.5%