Weaknesses of type CWE-89

13,619 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2024-10758MEDIUMcode-projects/anirbandutta9 Content Management System/News-Buzz index.php sql injectionEPSS 1.4%CVE-2021-21916HIGHAn exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-craftedEPSS 1.4%CVE-2021-21917HIGHAn exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-craftedEPSS 1.4%CVE-2021-21936HIGHA specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability aEPSS 1.4%CVE-2021-21915HIGHAn exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-craftedEPSS 1.4%CVE-2023-38100HIGHNETGEAR ProSAFE Network Management System clearAlertByIds SQL Injection Privilege Escalation VulnerabilityEPSS 1.4%CVE-2020-20913CRITICALSQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter.EPSS 1.4%CVE-2023-46954CRITICALSQL Injection vulnerability in Relativity ODA LLC RelativityOne v.12.1.537.3 Patch 2 and earlier allows a remote attacker to execute arbitraEPSS 1.4%CVE-2026-4060HIGHGeo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' ParameterEPSS 1.4%CVE-2025-48281CRITICALWordPress MyStyle Custom Product Designer plugin <= 3.21.1 - SQL Injection VulnerabilityEPSS 1.4%CVE-2022-42064CRITICALOnline Diagnostic Lab Management System version 1.0 remote exploit that bypasses login with SQL injection and then uploads a shell.EPSS 1.4%CVE-2022-42098HIGHKLiK SocialMediaWebsite version v1.0.1 is vulnerable to SQL Injection via the profile.php.EPSS 1.4%CVE-2022-31092HIGHSQL injection in pimcoreEPSS 1.4%CVE-2021-24451—Export Users With Meta < 0.6.5 - Authenticated SQL InjectionEPSS 1.4%CVE-2021-24130—WP Google Map Plugin < 4.1.5 - Authenticated SQL InjectionEPSS 1.4%CVE-2024-53908CRITICALAn issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.jsEPSS 1.4%CVE-2020-10512HIGHHGiga C&Cmail - SQL InjectionEPSS 1.4%CVE-2026-14554MEDIUMCheck & Log Email < 2.0.15 - Admin+ SQL Injection via d and s ParametersEPSS 1.4%CVE-2024-7456CRITICALSQL Injection in lunary-ai/lunaryEPSS 1.4%CVE-2022-30599—A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.EPSS 1.4%