Weaknesses of type CWE-89

11,984 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2020-37226HIGHJoomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortbyEPSS 0.3%CVE-2026-1517MEDIUMiomad Company Admin Block sql injectionEPSS 0.3%CVE-2026-6230HIGHTainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API ParameterEPSS 0.3%CVE-2025-5386MEDIUMJeeWMS cgformTransController.do transEditor sql injectionEPSS 0.3%CVE-2025-45240MEDIUMfoxcms v1.2.5 was discovered to contain a SQL injection vulnerability via the executeCommand method in DataBackup.php.EPSS 0.3%CVE-2020-37224HIGHJoomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortbyEPSS 0.3%CVE-2026-13226MEDIUMGroundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' ParameterEPSS 0.3%CVE-2026-4834HIGHWP ERP Pro <= 1.5.1 - Unauthenticated SQL Injection via 'search_key' ParameterEPSS 0.3%CVE-2025-15142MEDIUM9786 phpok3w show.php sql injectionEPSS 0.3%CVE-2026-1250HIGHCourt Reservation – Manage Your Court Bookings Online <= 1.10.11 - Unauthenticated SQL InjectionEPSS 0.3%CVE-2025-7631HIGHTime-Based Blind SQLi in Tumeva Internet Technologies' Tumeva Prime News SoftwareEPSS 0.3%CVE-2025-48137HIGHWordPress Interview plugin <= 1.01 - SQL Injection VulnerabilityEPSS 0.3%CVE-2020-37108HIGHPhpIX 2012 Professional - 'id' SQL InjectionEPSS 0.3%CVE-2025-8994MEDIUMWP Project Manager <= 2.6.26 - Authenticated (Subscriber+) SQL Injection via 'completed_at_operator'EPSS 0.3%CVE-2026-15445MEDIUMSEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'orderby' ParameterEPSS 0.3%CVE-2026-15458MEDIUMSEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'sort_field' ParameterEPSS 0.3%CVE-2026-2235HIGHHGiga｜C&Cm@il - SQL InjectionEPSS 0.3%CVE-2026-13331MEDIUMGroundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' ParameterEPSS 0.3%CVE-2025-15239HIGHQuanta Computer｜QOCA aim AI Medical Cloud Platform - SQL InjectionEPSS 0.3%CVE-2026-10620MEDIUMcode-projects Student Admission System index.php sql injectionEPSS 0.3%