Weaknesses of type CWE-89

13,302 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2026-32551CRITICALWordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-28001CRITICALWordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-49067CRITICALWordPress Advanced 301 and 302 Redirect plugin <= 1.6.9 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-61950CRITICALWordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-57683CRITICALWordPress WP Fast Total Search plugin <= 1.80.280 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-54849CRITICALWordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.11 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-73391CRITICALWordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-42665CRITICALWordPress WP Data Access plugin <= 5.5.70 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-32554CRITICALWordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerabilityEPSS 0.4%CVE-2024-34992HIGHSQL Injection vulnerability in the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules fEPSS 0.4%CVE-2026-66593CRITICALWordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-48886CRITICALWordPress JS Help Desk plugin <= 3.0.9 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-42672CRITICALWordPress WP Directory Kit plugin <= 1.5.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-5028MEDIUMEight Day Week Print Workflow <= 1.2.6 - Authenticated (Subscriber+) SQL Injection via 'title' ParameterEPSS 0.4%CVE-2024-13844MEDIUMPost SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns ParameterEPSS 0.4%CVE-2025-69216HIGHOpenSTAManager has an SQL Injection in Scadenzario Print TemplateEPSS 0.4%CVE-2026-3773MEDIUMAccessibility Suite by Ability, Inc <= 4.20 - Authenticated (Subscriber+) SQL Injection via 'scan_id' ParameterEPSS 0.4%CVE-2026-10105HIGHagno 2.6.5 SQL Injection via ClickHouse delete_by_metadata()EPSS 0.4%CVE-2025-7482MEDIUMPHPGurukul Vehicle Parking Management System print.php sql injectionEPSS 0.4%CVE-2026-48235HIGHOpen ISES Tickets < 3.44.2 SQL Injection in incs/remotes.inc.php via External GPS Tracker DataEPSS 0.4%