Weaknesses of type CWE-89

13,406 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2025-15014MEDIUMloganhong php loganSite Article article_detail.php sql injectionEPSS 0.2%CVE-2025-14259MEDIUMJihai Jshop MiniProgram Mall System api.html sql injectionEPSS 0.2%CVE-2025-68060HIGHWordPress Team Member plugin <= 8.5 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-13695HIGHSQL Injection in the Integratec ApplicationEPSS 0.2%CVE-2026-20061MEDIUMCisco Unity Connection SQL Injection VulnerabilityEPSS 0.2%CVE-2026-111472CRITICALSQL injection in TSG ProfleetEPSS 0.2%CVE-2026-12260CRITICALSQL injection in the NetBoard CRM demo platformEPSS 0.2%CVE-2026-105076HIGHWordPress Vitepos plugin <= 3.6.1 - SQL Injection vulnerabilityEPSS 0.2%CVE-2019-25746HIGHWordPress Sliced Invoices 3.8.2 SQL Injection via post ParameterEPSS 0.2%CVE-2026-96826HIGHWordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-42708HIGHWordPress WP Post Author plugin <= 4.0.0 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-109687HIGHWordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerabilityEPSS 0.2%CVE-2021-47980HIGHFuel CMS 1.4.13 Blind SQL Injection via col ParameterEPSS 0.2%CVE-2026-104753MEDIUMRank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' ParameterEPSS 0.2%CVE-2026-42713HIGHWordPress Post title marquee scroll plugin <= 9.9 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-42710HIGHWordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-42721HIGHWordPress affiliate-toolkit plugin <= 3.9.1 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-42720HIGHWordPress Dynamic User Directory plugin <= 2.4 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-62060HIGHWordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-62097HIGHWordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerabilityEPSS 0.2%