Weaknesses of type CWE-89

12,860 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2020-7493—A CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in EcoStruxure Operator EPSS 1.1%CVE-2017-20128HIGHKB Messages PHP Script sql injectionEPSS 1.1%CVE-2024-44542CRITICALSQL Injection vulnerability in todesk v.1.1 allows a remote attacker to execute arbitrary code via the /todesk.com/news.html parameter.EPSS 1.1%CVE-2022-21720MEDIUMSQL injection using custom CSS administration form in GLPIEPSS 1.1%CVE-2021-21920HIGHA specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability aEPSS 1.1%CVE-2022-42109CRITICALOnline-shopping-system-advanced 1.0 was discovered to contain a SQL injection vulnerability via the p parameter at /shopping/product.php.EPSS 1.1%CVE-2021-21918HIGHA specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability aEPSS 1.1%CVE-2021-21923HIGHA specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability aEPSS 1.1%CVE-2021-21921HIGHA specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability aEPSS 1.1%CVE-2024-1863CRITICALSante PACS Server Token Endpoint SQL Injection Remote Code Execution VulnerabilityEPSS 1.1%CVE-2021-21919HIGHA specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability aEPSS 1.1%CVE-2024-39841HIGHA SQL Injection vulnerability exists in the service configuration functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10EPSS 1.1%CVE-2021-39351HIGHWP Bannerize 2.0.0 - 4.0.2 - Authenticated SQL InjectionEPSS 1.1%CVE-2021-36348MEDIUMiDRAC9 versions prior to 5.00.20.00 contain an input injection vulnerability. A remote authenticated malicious user with low privileges may EPSS 1.1%CVE-2017-12302—A vulnerability in the Cisco Unified Communications Manager SQL database interface could allow an authenticated, remote attacker to impact tEPSS 1.1%CVE-2022-39179HIGHCollege Management System v1.0 - Authenticated remote code executionEPSS 1.1%CVE-2022-0153CRITICALSQL Injection in forkcms/forkcmsEPSS 1.1%CVE-2020-20491HIGHSQL injection vulnerability in OpenCart v.2.2.00 thru 3.0.3.2 allows a remote attacker to execute arbitrary code via the Fba plugin functionEPSS 1.1%CVE-2020-21400HIGHSQL injection vulnerability in gaozhifeng PHPMyWind v.5.6 allows a remote attacker to execute arbitrary code via the id variable in the modiEPSS 1.1%CVE-2025-59499HIGHMicrosoft SQL Server Elevation of Privilege VulnerabilityEPSS 1.1%