Weaknesses of type CWE-89

13,302 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2026-39512CRITICALWordPress GeoDirectory plugin <= 2.8.152 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-59533CRITICALWordPress Relevanssi Light plugin <= 1.2.2 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-54812CRITICALWordPress Motors plugin <= 1.4.109 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-59527CRITICALWordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-54825CRITICALWordPress wpDataTables plugin <= 7.4 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-66446CRITICALWordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-66680CRITICALWordPress Locatoraid Store Locator plugin <= 3.9.72 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-59514CRITICALWordPress Buddyboss Platform plugin <= 3.0.5 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-39530CRITICALWordPress SpeakOut! Email Petitions plugin <= 4.6.5 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-39494CRITICALWordPress Product Filter by WBW plugin <= 3.1.2 - SQL Injection vulnerabilityEPSS 0.4%CVE-2025-22799HIGHWordPress Neon Product Designer Plugin <= 2.2.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-49076CRITICALWordPress JetEngine plugin <= 3.8.9.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-61966CRITICALWordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2023-4608MEDIUMAn authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command.  This afEPSS 0.4%CVE-2026-57679CRITICALWordPress GeekyBot plugin <= 1.2.5 - SQL Injection vulnerabilityEPSS 0.4%CVE-2025-20620HIGHSQL Injection vulnerability exists in STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected product may EPSS 0.4%CVE-2026-73185CRITICALWordPress NGG Smart Image Search plugin < 4.0.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-54843CRITICALWordPress MDTF plugin <= 1.3.7 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-73187CRITICALWordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-42684CRITICALWordPress WP Job Portal plugin <= 2.5.1 - SQL Injection vulnerabilityEPSS 0.4%