Weaknesses of type CWE-89

13,377 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2026-13752MEDIUMSnowflake CLI SQL Injection Through Improper Neutralization of Parameters in Secret Creation and SPCS Service Log CommandsEPSS 0.3%CVE-2025-41233MEDIUMDescription: VMware AVI Load Balancer contains an authenticated blind SQL Injection vulnerability. VMware has evaluated the severity of theEPSS 0.3%CVE-2018-25209HIGHOpenBiz Cubi Lite 3.0.8 SQL Injection via username ParameterEPSS 0.3%CVE-2025-9690MEDIUMSourceCodester Advanced School Management System vendordetails sql injectionEPSS 0.3%CVE-2025-10122MEDIUMMaccms10 Database.php rep sql injectionEPSS 0.3%CVE-2026-87034HIGHTanium addressed a SQL injection vulnerability in Comply.EPSS 0.3%CVE-2025-12927MEDIUMDedeBIZ archives_add.php sql injectionEPSS 0.3%CVE-2020-37141HIGHAMSS++ v 4.31 - 'id' SQL InjectionEPSS 0.3%CVE-2025-12859MEDIUMDedeBIZ templets_one_edit.php sql injectionEPSS 0.3%CVE-2025-40639HIGHSQL injection in EventobotEPSS 0.3%CVE-2025-7662MEDIUMGestion de tarifs <= 1.4 - Authenticated (Contributor+) SQL InjectionEPSS 0.3%CVE-2025-64084MEDIUMAn authenticated SQL injection vulnerability exists in Cloudlog 2.7.5 and earlier. The vucc_details_ajax function in application/controllersEPSS 0.3%CVE-2021-47720HIGHOrangescrum 1.8.0 Authenticated SQL Injection via Multiple ParametersEPSS 0.3%CVE-2025-9148MEDIUMCodePhiliaX Chat2DB JDBC Connection DataSourceController.java sql injectionEPSS 0.3%CVE-2025-36368MEDIUMIBM Sterling B2B Integrator and IBM Sterling File Gateway SQL InjectionEPSS 0.3%CVE-2025-12861MEDIUMDedeBIZ spec_add.php sql injectionEPSS 0.3%CVE-2025-12860MEDIUMDedeBIZ freelist_main.php sql injectionEPSS 0.3%CVE-2024-54447HIGHBlind SQLi in Saved SearchEPSS 0.3%CVE-2026-34018MEDIUMAn SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the pEPSS 0.3%CVE-2024-54446HIGHBlind SQLi in Document HistoryEPSS 0.3%