Weaknesses of type CWE-89

12,845 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2024-30922CRITICALSQL Injection vulnerability in DerbyNet v9.0 allows a remote attacker to execute arbitrary code via the where Clause in Award Document RendeEPSS 1.4%CVE-2026-19949HIGHAll-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code ExecutionEPSS 1.4%CVE-2018-14623MEDIUMA SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SEPSS 1.4%CVE-2024-30801MEDIUMSQL Injection vulnerability in Cloud based customer service management platform v.1.0.0 allows a local attacker to execute arbitrary code viEPSS 1.4%CVE-2006-5603CRITICALSQL injection vulnerability in pop_mail.asp in Snitz Forums 2000 3.4.06 allows remote attackers to execute arbitrary SQL commands via the RCEPSS 1.4%CVE-2022-30599—A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.EPSS 1.4%CVE-2024-10758MEDIUMcode-projects/anirbandutta9 Content Management System/News-Buzz index.php sql injectionEPSS 1.4%CVE-2022-25811—Transposh WordPress Translation <= 1.0.8 - Admin+ SQL InjectionEPSS 1.4%CVE-2023-38100HIGHNETGEAR ProSAFE Network Management System clearAlertByIds SQL Injection Privilege Escalation VulnerabilityEPSS 1.4%CVE-2020-20913CRITICALSQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter.EPSS 1.4%CVE-2025-0565MEDIUMZZCMS index.php sql injectionEPSS 1.4%CVE-2021-24130—WP Google Map Plugin < 4.1.5 - Authenticated SQL InjectionEPSS 1.4%CVE-2021-24451—Export Users With Meta < 0.6.5 - Authenticated SQL InjectionEPSS 1.4%CVE-2022-31092HIGHSQL injection in pimcoreEPSS 1.4%CVE-2025-48281CRITICALWordPress MyStyle Custom Product Designer plugin <= 3.21.1 - SQL Injection VulnerabilityEPSS 1.4%CVE-2024-53908CRITICALAn issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.jsEPSS 1.4%CVE-2020-10512HIGHHGiga C&Cmail - SQL InjectionEPSS 1.4%CVE-2024-7456CRITICALSQL Injection in lunary-ai/lunaryEPSS 1.4%CVE-2024-12727CRITICALA pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows accesEPSS 1.4%CVE-2021-24483—Poll Maker < 3.2.1 - Authenticated Blind SQL InjectionsEPSS 1.4%