Weaknesses of type CWE-89

13,374 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2025-69306CRITICALWordPress Electio Core plugin <= 1.4 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-4230MEDIUMvanna-ai vanna Endpoint __init__.py update_sql sql injectionEPSS 0.3%CVE-2025-3534MEDIUMPowerCreator CMS OpenPublicCourse.aspx sql injectionEPSS 0.3%CVE-2025-12342MEDIUMSerdar Bayram Ghost Hot Spot Login Auth.php sql injectionEPSS 0.3%CVE-2025-12248MEDIUMCLTPHP search.html sql injectionEPSS 0.3%CVE-2025-3009MEDIUMJinher Network OA NetDiskProperty.aspx sql injectionEPSS 0.3%CVE-2025-10115MEDIUMSiempreCMS user_search_ajax.php sql injectionEPSS 0.3%CVE-2026-103232MEDIUMAdithyaYelloju Restaurant-Management-System table_booking.php mysqli_query sql injectionEPSS 0.3%CVE-2025-50984MEDIUMdiskover-web v2.3.0 Community Edition is vulnerable to multiple boolean-based blind SQL injection flaws in its Elasticsearch configuration fEPSS 0.3%CVE-2026-11531MEDIUMimvks786 student_management_system Administrator Login Endpoint admin_login.php sql injectionEPSS 0.3%CVE-2020-36972HIGHSmartBlog 2.0.1 - 'id_post' Blind SQL injectionEPSS 0.3%CVE-2025-7638MEDIUMForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` ParameterEPSS 0.3%CVE-2026-112152MEDIUMvraj404 Criminal-Management-System Search searchOff.php mysqli_query sql injectionEPSS 0.3%CVE-2026-10877MEDIUMSourceCodester Ship Ferry Ticket Reservation System Admin Login login.php sql injectionEPSS 0.3%CVE-2025-12277MEDIUMAbdullah-Hasan-Sajjad Online-School studentLogin.php sql injectionEPSS 0.3%CVE-2025-60269CRITICALJEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the src/main/java/org/jeecgframework/web/cgreport/controEPSS 0.3%CVE-2025-10036MEDIUMFeatured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL InjectionEPSS 0.3%CVE-2025-11654MEDIUMyousaf530 Inferno Online Clothing Store log.php sql injectionEPSS 0.3%CVE-2024-46078HIGHitsourcecode Sports Management System Project 1.0 is vulnerable to SQL Injection in the function delete_category of the file sports_scheduliEPSS 0.3%CVE-2026-11530MEDIUMimvks786 student_management_system Login index.ph sql injectionEPSS 0.3%