Weaknesses of type CWE-89

13,618 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2022-3246HIGHBlog2Social < 6.9.10 - Subscriber+ SQLiEPSS 1.5%CVE-2023-39344CRITICALsocial-media-skeleton vulnerable to Pre-Auth SQLi leading to RCEEPSS 1.5%CVE-2026-2416HIGHGeo Mashup <= 1.13.17 - Unauthenticated SQL Injection via 'sort' ParameterEPSS 1.5%CVE-2022-31058HIGHSQL injection via the field name of a tracker in TuleapEPSS 1.5%CVE-2020-13587MEDIUMAn exploitable SQL injection vulnerability exists in the "forms_fields_rules/rules" page of the Rukovoditel Project Management App 2.7.2. A EPSS 1.5%CVE-2020-13591MEDIUMAn exploitable SQL injection vulnerability exists in the "access_rules/rules_form" page of the Rukovoditel Project Management App 2.7.2. A sEPSS 1.5%CVE-2020-13592MEDIUMAn exploitable SQL injection vulnerability exists in "global_lists/choices" page of the Rukovoditel Project Management App 2.7.2. A speciallEPSS 1.5%CVE-2021-24149—Modern Events Calendar Lite < 5.16.6 - Authenticated SQL InjectionEPSS 1.5%CVE-2021-24137—Blog2Social: Social Media Auto Post & Scheduler < 6.3.1 - Authenticated SQL InjectionEPSS 1.5%CVE-2022-31890CRITICALSQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae viaEPSS 1.5%CVE-2024-42005CRITICALAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONFEPSS 1.5%CVE-2021-24865—Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL InjectionEPSS 1.5%CVE-2021-25045—Asgaros Forum < 1.15.15 - Admin+ SQL Injection via forum_idEPSS 1.5%CVE-2019-12710MEDIUMCisco Unified Communications Manager SQL Injection VulnerabilityEPSS 1.5%CVE-2024-23539HIGHApache Fineract: Under certain system configurations, the sqlSearch parameter for specific endpoints was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.EPSS 1.5%CVE-2025-0565MEDIUMZZCMS index.php sql injectionEPSS 1.5%CVE-2025-3096CRITICALClinics Patient Management System SQL InjectionEPSS 1.5%CVE-2021-25069—WordPress Download Manager < 3.2.34 - Authenticated SQL Injection to Reflected XSSEPSS 1.5%CVE-2022-0420—RegistrationMagic < 5.0.2.2 - Admin+ SQL InjectionEPSS 1.5%CVE-2022-1023—Podcast Importer SecondLine < 1.3.8 - Admin+ SQLiEPSS 1.5%