Weaknesses of type CWE-89

13,370 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2023-42239LOWAn issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiEPSS 0.3%CVE-2025-11980MEDIUMQuick Featured Images <= 13.7.3 - Authenticated (Editor+) SQL Injection via delete_orphanedEPSS 0.3%CVE-2026-57588LOWSQL Injection in Nessus via Malicious Scan Result File ImportEPSS 0.3%CVE-2023-42242LOWAn issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GETEPSS 0.3%CVE-2025-52618MEDIUMHCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerabilityEPSS 0.3%CVE-2026-2412MEDIUMQuiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' ParameterEPSS 0.3%CVE-2025-11972MEDIUMTag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.0 - Authenticated (Editor+) SQL InjectionEPSS 0.3%CVE-2023-42238LOWAn issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiEPSS 0.3%CVE-2026-18561HIGHUnlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL InjectionEPSS 0.3%CVE-2026-17543HIGHSQL injection in ext-pgsql via E'...' backslash breakoutEPSS 0.3%CVE-2026-96267HIGHWP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' ParameterEPSS 0.3%CVE-2025-11981MEDIUMSchool Management System – WPSchoolPress <= 2.2.23 - Authenticated (Administrator+) SQL InjectionEPSS 0.3%CVE-2026-92766HIGHVitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' ParameterEPSS 0.3%CVE-2026-4614MEDIUMitsourcecode sanitize or validate this input Parameter subjects.php sql injectionEPSS 0.3%CVE-2026-4593MEDIUMerupts erupt MCP Tool EruptDataQuery.java EruptDataQuery sql injectionEPSS 0.3%CVE-2025-69337CRITICALWordPress Wolmart Core plugin <= 1.9.6 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-60118HIGHWordPress PGS Core Plugin <= 5.9.0 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-4485MEDIUMitsourcecode College Management System search_student.php sql injectionEPSS 0.3%CVE-2026-4507MEDIUMMindinventory MindSQL mindsql_core.py ask_db sql injectionEPSS 0.3%CVE-2026-105469MEDIUMgirishsaraf Online-Appointment-Booking-System AJAX Endpoint get_town.php sql injectionEPSS 0.3%