Weaknesses of type CWE-89

13,394 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2023-41532HIGHHospital Management System v4 was discovered to contain a SQL injection vulnerability via the doctor_contact parameter in doctorsearch.php.EPSS 0.3%CVE-2025-14207MEDIUMtushar-2223 Hotel-Management-System invoiceprint.php sql injectionEPSS 0.3%CVE-2025-7156MEDIUMhitsz-ids airda completions execute sql injectionEPSS 0.3%CVE-2026-18737HIGHShlink Blind SQL Injection via tags/stats orderBy ParameterEPSS 0.3%CVE-2025-8536CRITICALSQL Injection in DobryCMSEPSS 0.3%CVE-2026-103248HIGHn8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via SupabaseEPSS 0.3%CVE-2026-30273HIGHpandas-ai v3.0.0 was discovered to contain a SQL injection vulnerability via the pandasai.agent.base._execute_sql_query component.EPSS 0.3%CVE-2026-24913HIGHSQL Injection vulnerability exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, information stored in the databaEPSS 0.3%CVE-2021-47711HIGHKentico Xperience <= 13.0.52 Online Marketing Macros SQL InjectionEPSS 0.3%CVE-2025-6768MEDIUMsfturing hosp_order HospitalServiceImpl.java findAllHosByCondition sql injectionEPSS 0.3%CVE-2025-51671MEDIUMA SQL injection vulnerability was discovered in the PHPGurukul Dairy Farm Shop Management System 1.3. The vulnerability allows remote attackEPSS 0.3%CVE-2025-39496CRITICALWordPress WooBeWoo Product Filter Pro plugin < 2.9.6 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-49059CRITICALWordPress CleverReach® WP Plugin <= 1.5.20 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-107752MEDIUMWelcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' CookieEPSS 0.3%CVE-2025-54707CRITICALWordPress MDTF Plugin <= 1.3.3.7 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-11020HIGHRemote Code Execution in MarkAny SafePC EnterpriseEPSS 0.3%CVE-2025-67921HIGHWordPress Lobo theme < 2.8.6 - SQL Injection vulnerabilityEPSS 0.3%CVE-2024-49588MEDIUMMultiple authenticated SQL injections in oracle-sidecarEPSS 0.3%CVE-2025-62655LOWSQL injection in Cargo via Special:CargoExportEPSS 0.3%CVE-2025-67516HIGHWordPress Store Locator WordPress plugin <= 1.6.2 - SQL Injection vulnerabilityEPSS 0.3%