Weaknesses of type CWE-89

13,302 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2025-20620HIGHSQL Injection vulnerability exists in STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected product may EPSS 0.4%CVE-2026-54819CRITICALWordPress Listdom plugin <= 5.4.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-32539CRITICALWordPress PublishPress Revisions plugin <= 3.7.23 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-42639CRITICALWordPress GD Rating System plugin <= 3.6.2 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-84768CRITICALWordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-73185CRITICALWordPress NGG Smart Image Search plugin < 4.0.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-65508CRITICALWordPress Simply Schedule Appointments plugin <= 1.6.12.10 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-73183CRITICALWordPress Maps Marker Pro plugin <= 4.32 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-65520CRITICALWordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-74015CRITICALWordPress Readabler plugin < 2.0.18 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-56068CRITICALWordPress JetEngine plugin <= 3.8.10.2 - SQL Injection vulnerabilityEPSS 0.4%CVE-2025-3872HIGHPrivilege escalation by altering payload in contact formEPSS 0.4%CVE-2026-61969CRITICALWordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-66458CRITICALWordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-54827CRITICALWordPress Real Estate 7 theme <= 3.5.9 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-66659CRITICALWordPress Tablesome Table plugin <= 1.2.9 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-49776CRITICALWordPress GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin <= 2.32.6 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-42773CRITICALWordPress eMagicOne Store Manager plugin <= 1.3.2 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-32479CRITICALWordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-0803MEDIUMPHPGurukul Online Course Registration System enroll.php sql injectionEPSS 0.4%