Weaknesses of type CWE-89

12,846 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2023-31939HIGHSQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the costomer_iEPSS 1.3%CVE-2025-10210MEDIUMyanyutao0402 ChanCMS Api.js search sql injectionEPSS 1.3%CVE-2023-27707HIGHSQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dEPSS 1.3%CVE-2023-31940HIGHSQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the page_id paEPSS 1.3%CVE-2023-27709HIGHSQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dEPSS 1.3%CVE-2023-31938HIGHSQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the emp_id parEPSS 1.3%CVE-2023-25196—Apache Fineract: SQL injection vulnerability EPSS 1.3%CVE-2017-6754—A vulnerability in the web-based management interface of the Cisco Smart Net Total Care (SNTC) Software Collector Appliance 3.11 could allowEPSS 1.3%CVE-2021-35048CRITICALUnauthenticated SQL Injection Vulnerability in Fidelis Network and DeceptionEPSS 1.3%CVE-2022-0190—Ad Invalid Click Protector (AICP) < 1.2.6 - Authenticated SQL InjectionEPSS 1.3%CVE-2021-24456—Quiz Maker < 6.2.0.9 - Multiple Authenticated Blind SQL InjectionsEPSS 1.3%CVE-2024-23538CRITICALApache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.EPSS 1.3%CVE-2024-40502CRITICALSQL injection vulnerability in Hospital Management System Project in ASP.Net MVC 1 allows aremote attacker to execute arbitrary code via theEPSS 1.3%CVE-2022-3494HIGHComplianz (Free < 6.3.4, Premium < 6.3.6) - Translator SQLiEPSS 1.3%CVE-2021-25037—All In One SEO < 4.1.5.3 - Authenticated SQL InjectionEPSS 1.3%CVE-2021-26634CRITICALMaxboard multiple vulnerabilitiesEPSS 1.3%CVE-2011-0467HIGHSQL injection in SUSE studio via select parameterEPSS 1.3%CVE-2026-44680HIGHMikroORM: SQL injection via runtime-controlled identifiers and JSON-path keysEPSS 1.3%CVE-2023-52335HIGHAdvantech iView ConfigurationServlet SQL Injection Information Disclosure VulnerabilityEPSS 1.3%CVE-2022-2958—BadgeOS < 3.7.1.3 - Subscriber+ SQLiEPSS 1.3%