Weaknesses of type CWE-89

12,846 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2022-1472—Better Find and Replace < 1.3.6 - Admin+ SQLiEPSS 1.3%CVE-2021-24143—AccessPress Social Icons < 1.8.1 - Authenticated SQL InjectionEPSS 1.3%CVE-2025-22461HIGHSQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admiEPSS 1.3%CVE-2021-24185—Tutor LMS < 1.7.7 - SQL Injection via tutor_place_ratingEPSS 1.3%CVE-2021-24186—Tutor LMS < 1.8.3 - SQL Injection via tutor_answering_quiz_question/get_answer_by_idEPSS 1.3%CVE-2021-24181—Tutor LMS < 1.7.7 - SQL Injection via tutor_mark_answer_as_correctEPSS 1.3%CVE-2020-3936CRITICALUnisoon UltraLog Express - SQL InjectionEPSS 1.2%CVE-2025-50455CRITICALSQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1.EPSS 1.2%CVE-2023-36189HIGHSQL injection vulnerability in langchain before v0.0.247 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain cEPSS 1.2%CVE-2021-1222MEDIUMCisco Smart Software Manager Satellite SQL Injection VulnerabilityEPSS 1.2%CVE-2021-37497CRITICALSQL injection vulnerability in route of PbootCMS 3.0.5 allows remote attackers to run arbitrary SQL commands via crafted GET request.EPSS 1.2%CVE-2023-48118CRITICALSQL Injection vulnerability in Quest Analytics LLC IQCRM v.2023.9.5 allows a remote attacker to execute arbitrary code via a crafted requestEPSS 1.2%CVE-2022-39041CRITICALaEnrich a+HRD - SQL InjectionEPSS 1.2%CVE-2024-54820CRITICALXOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page. This vulnerabiEPSS 1.2%CVE-2020-29168CRITICALSQL Injection vulnerability in Projectworlds Online Doctor Appointment Booking System, allows attackers to gain sensitive information via thEPSS 1.2%CVE-2017-11161—Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary EPSS 1.2%CVE-2022-24628HIGHAn issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is authenticated SQL injection in the id parameter EPSS 1.2%CVE-2023-47460HIGHSQL injection vulnerability in Knovos Discovery v.22.67.0 allows a remote attacker to execute arbitrary code via the /DiscoveryProcess/ServiEPSS 1.2%CVE-2021-24142—301 Redirects - Easy Redirect Manager < 2.51 - Authenticated SQL InjectionEPSS 1.2%CVE-2022-42064CRITICALOnline Diagnostic Lab Management System version 1.0 remote exploit that bypasses login with SQL injection and then uploads a shell.EPSS 1.2%