Weaknesses of type CWE-89

13,618 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2022-1006—Advanced Booking Calendar < 1.7.1 - Admin+ SQLiEPSS 1.5%CVE-2022-40030CRITICALSourceCodester Simple Task Managing System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at changeStEPSS 1.5%CVE-2026-54419CRITICALPIAF-HMS multiple unauthenticated SQL injection vulnerabilities via mysql_queryEPSS 1.5%CVE-2022-40943CRITICALDairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via bwdate-report-ds.php file.EPSS 1.5%CVE-2024-43918CRITICALWordPress WBW Product Table PRO plugin <= 1.9.4 - Unauthenticated Arbitrary SQL Query Execution vulnerabilityEPSS 1.5%CVE-2026-3396HIGHWCAPF – WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL InjectionEPSS 1.5%CVE-2018-0404—Cisco RV180W Wireless-N Multifunction VPN Router SQL Injection VulnerabilityEPSS 1.5%CVE-2021-22856CRITICALChanGate EnterPrise Co., Ltd property management system - SQL InjectionEPSS 1.5%CVE-2022-37204CRITICALFinal CMS 5.1.0 is vulnerable to SQL Injection.EPSS 1.5%CVE-2022-23911—AP Custom Testimonial < 1.4.8 - Admin+ SQL InjectionEPSS 1.5%CVE-2022-0362MEDIUMSQL Injection in star7th/showdocEPSS 1.5%CVE-2022-0383—WP Review Slider < 11.0 - Admin+ SQL InjectionEPSS 1.5%CVE-2022-24844HIGHSQL Injection in github.com/flipped-aurora/gin-vue-adminEPSS 1.5%CVE-2023-4309CRITICALElection Services Co. (ESC) Internet Election Service is vulnerable to SQL injection in multiple pages and parameters. These vulnerabilitiesEPSS 1.5%CVE-2019-7003CRITICALACM SQL InjectionEPSS 1.5%CVE-2023-7172HIGHPHPGurukul Hospital Management System Admin Dashboard sql injectionEPSS 1.5%CVE-2021-24125—Contact Form Submissions < 1.7.1 - Authenticated SQL InjectionEPSS 1.5%CVE-2022-32964CRITICALITPison OMICARD EDM - SQL InjectionEPSS 1.5%CVE-2026-44680HIGHMikroORM: SQL injection via runtime-controlled identifiers and JSON-path keysEPSS 1.5%CVE-2026-54647HIGHCubeCart : SQL Injection via download_expire Parameter in settings.index.inc.phpEPSS 1.4%