Weaknesses of type CWE-89

11,952 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2026-34185HIGHSQL Injection in Hydrosystem Control SystemEPSS 0.3%CVE-2025-68570HIGHWordPress Captivate Sync plugin <= 3.2.2 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-12850HIGHMy auctions allegro <= 3.6.32 - Unauthenticated SQL Injection via auction_idEPSS 0.3%CVE-2024-33009MEDIUMSQL injection vulnerability in SAP Global Label Management (GLM)EPSS 0.3%CVE-2025-40635CRITICALSQL injection at ComerzziaEPSS 0.3%CVE-2025-40682HIGHSQL injection vulnerability in Human Resource Management SystemEPSS 0.3%CVE-2025-14246MEDIUMcode-projects Simple Shopping Cart settings.php sql injectionEPSS 0.3%CVE-2024-50584MEDIUMSQL InjectionEPSS 0.3%CVE-2025-14254HIGHGalaxy Software Services｜Vitals ESP - SQL InjectionEPSS 0.3%CVE-2025-14255HIGHGalaxy Software Services｜Vitals ESP - SQL InjectionEPSS 0.3%CVE-2025-67928CRITICALWordPress Automotive Listings plugin <= 18.6 - SQL Injection vulnerabilityEPSS 0.3%CVE-2020-37141HIGHAMSS++ v 4.31 - 'id' SQL InjectionEPSS 0.3%CVE-2025-3318MEDIUMKenj_Frog 肯尼基蛙 company-financial-management 公司财务管理系统 ShangpinleixingController.java page sql injectionEPSS 0.3%CVE-2026-52693CRITICALWordPress eCommerce Product Catalog plugin <= 3.5.5 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-44238HIGHFreePBX: Authenticated SQL Injection via ORDER BY in CDR ReportsEPSS 0.3%CVE-2025-12166HIGHSimply Schedule Appointments <= 1.6.9.9 - Unauthenticated SQL Injection via `order` and `append_where_sql` ParametersEPSS 0.3%CVE-2026-3105HIGHSQL Injection in Contact Activity API SortingEPSS 0.3%CVE-2026-49067CRITICALWordPress Advanced 301 and 302 Redirect plugin <= 1.6.9 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-49776CRITICALWordPress GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin <= 2.32.6 - SQL Injection vulnerabilityEPSS 0.3%CVE-2024-9149HIGHSQLi in Wind Media's E-Commerce Website TemplateEPSS 0.3%