Weaknesses of type CWE-89

13,341 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2026-19787MEDIUMSourceCodester Air Cargo Management System Master.php save_cargo_type sql injectionEPSS 0.3%CVE-2026-10731CRITICALSQL injection in Nemon productsEPSS 0.3%CVE-2018-25371HIGHmooSocial Store Plugin 2.6 SQL Injection via product parameterEPSS 0.3%CVE-2024-13596MEDIUMWordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress <= 1.7.5 - Authenticated (Contributor+) SQL InjectionEPSS 0.3%CVE-2019-25573HIGHGreen CMS 2.x SQL Injection via cat ParameterEPSS 0.3%CVE-2025-25462MEDIUMA SQL Injection vulnerability was found in /admin/add-propertytype.php in PHPGurukul Land Record System Project in PHP v1.0 allows remote atEPSS 0.3%CVE-2019-25501HIGHSimple Job Script SQL Injection via delete_application_ajax.phpEPSS 0.3%CVE-2025-40731HIGHSQL injection vulnerability in Daily Expense ManagerEPSS 0.3%CVE-2025-12482HIGHBooking for Appointments and Events Calendar – Amelia <= 1.2.35 - Unauthenticated SQL Injection via searchEPSS 0.3%CVE-2022-39072MEDIUMThere is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of the input parameters of the SEPSS 0.3%CVE-2024-13809MEDIUMHero Slider - WordPress Slider Plugin <= 1.3.5 - Authenticated (Subscriber+) SQL InjectionEPSS 0.3%CVE-2025-9807HIGHThe Events Calendar <= 6.15.1 - Unauthenticated SQL InjectionEPSS 0.3%CVE-2024-13781MEDIUMHero Maps Premium - Customizable Google Maps Plugin <= 2.3.9 - Authenticated (Subscriber+) SQL InjectionEPSS 0.3%CVE-2024-12607MEDIUMSchool Management System for Wordpress <= 92.0.0 - Authenticated (Subscriber+) SQL Injection via 'mj_smgt_show_event_task'EPSS 0.3%CVE-2026-17227MEDIUMIBM Db2 Mirror for i is affected by multiple vulnerabilitiesEPSS 0.3%CVE-2025-2200CRITICALSQL injection vulnerability in the Innovación y Cualificación IcProgreso pluginEPSS 0.3%CVE-2024-30864MEDIUMnetentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/config_ISCGroupTimePolicy.php.EPSS 0.3%CVE-2025-12503HIGHDigiwin｜EasyFlow .NET and EasyFlow AiNetEPSS 0.3%CVE-2026-22335HIGHWordPress WooCommerce Frontend Manager – Ultimate plugin < 6.7.7 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-20327MEDIUMCisco Unified Intelligence Center SQL Injection VulnerabilityEPSS 0.3%