Weaknesses of type CWE-89

12,013 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2026-36873LOWSourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_admin.php.EPSS 0.2%CVE-2025-52637MEDIUMMultiple security vulnerabilities affect HCL AIONEPSS 0.2%CVE-2026-36920LOWSourcecodester Online Reviewer System v1.0 is vulnerable to SQL Injection in the file /system/system/admins/assessments/examproper/questionsEPSS 0.2%CVE-2026-32458HIGHWordPress WOLF plugin <= 1.0.8.7 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-56052HIGHWordPress Funnel Builder by FunnelKit plugin <= 3.15.0.5 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-33723HIGHAVideo Vulnerable to SQL Injection in Subscribe Endpoint via Unsanitized user_id Parameter in subscribe.phpEPSS 0.2%CVE-2021-47872HIGHSEO Panel < 4.9.0 - 'order_col' Blind SQL InjectionEPSS 0.2%CVE-2026-44744MEDIUMSQL Injection vulnerability in SAP S/4HANAEPSS 0.2%CVE-2026-6225MEDIUMTaskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.6 - Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project_search' ParameterEPSS 0.2%CVE-2026-4776HIGHAn SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested querEPSS 0.2%CVE-2023-45256MEDIUMMultiple SQL injection vulnerabilities in the EuroInformation MoneticoPaiement module before 1.1.1 for PrestaShop allow remote attackers to EPSS 0.2%CVE-2026-40834HIGHAuthenticated SQLi in saveDashboardLayout functionEPSS 0.2%CVE-2026-45214HIGHWordPress Xpro Elementor Addons plugin <= 1.5.1 - SQL Injection vulnerabilityEPSS 0.2%CVE-2025-40888MEDIUMAuthenticated SQL Injection on CLI functionality in Guardian/CMC before 25.3.0EPSS 0.2%CVE-2026-42741HIGHWordPress Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend plugin <= 3.3.2 - SQL Injection vulnerabilityEPSS 0.2%CVE-2025-40885MEDIUMAuthenticated SQL Injection on Smart Polling functionality in Guardian/CMC before 25.2.0EPSS 0.2%CVE-2026-42742HIGHWordPress Views for WPForms plugin <= 3.4.6 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-40833HIGHAuthenticated SQLi in saveDashboardLayout functionEPSS 0.2%CVE-2026-40836HIGHAuthenticated SQLi in inmessage modelEPSS 0.2%CVE-2026-45211HIGHWordPress APIExperts Square for WooCommerce plugin <= 4.7.1 - SQL Injection vulnerabilityEPSS 0.2%