Weaknesses of type CWE-89

12,846 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2016-10553—sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server iEPSS 1.3%CVE-2024-3690MEDIUMPHPGurukul Small CRM Change Password sql injectionEPSS 1.3%CVE-2023-45657HIGHWordPress Nexter Theme <= 2.0.3 is vulnerable to SQL InjectionEPSS 1.3%CVE-2022-2269—Website File Changes Monitor < 1.8.3 - Admin+ SQLiEPSS 1.3%CVE-2022-42744CRITICALCandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the apEPSS 1.3%CVE-2022-45889HIGHPlanet eStream before 6.72.10.07 allows a remote attacker (who is a publisher or admin) to obtain access to all records stored in the databaEPSS 1.3%CVE-2022-1800—Export any WordPress data to XML/CSV < 1.3.5 - Admin+ SQL InjectionEPSS 1.3%CVE-2021-24877—MainWP Child < 4.1.8 - Admin+ SQL InjectionEPSS 1.3%CVE-2017-20127HIGHKB Login Authentication Script sql injectionEPSS 1.3%CVE-2025-22214MEDIUMLandray EIS 2001 through 2006 allows Message/fi_message_receiver.aspx?replyid= SQL injection.EPSS 1.3%CVE-2022-40877CRITICALExam Reviewer Management System 1.0 is vulnerable to SQL Injection via the ‘id’ parameter.EPSS 1.3%CVE-2022-0267—AdRotate < 5.8.22 - Admin+ SQL InjectionEPSS 1.3%CVE-2021-4208—ExportFeed <= 2.0.1.0 - Admin+ SQL InjectionEPSS 1.3%CVE-2021-24778—Tradetracker-Store < 4.6.60 - Admin+ SQL InjectionEPSS 1.3%CVE-2021-24861—Quotes Collection <= 2.5.2 - Admin+ SQL InjectionEPSS 1.3%CVE-2021-32790MEDIUMBlind SQL Injection possible via Authenticated Web-hook Search API EndpointEPSS 1.3%CVE-2025-27240HIGHSecondary-order SQL injection in Zabbix Server when deleting an autoregistered hostEPSS 1.3%CVE-2020-10617—There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access toEPSS 1.3%CVE-2020-12034—Products that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6EPSS 1.3%CVE-2017-9443HIGHBigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json iEPSS 1.3%