Weaknesses of type CWE-89

13,416 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2024-33501MEDIUMTwo improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in Fortinet FortiAnalyzer veEPSS 0.2%CVE-2026-28576CRITICALIn Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disEPSS 0.2%CVE-2026-40131LOWSQL Injection vulnerability in SAP HANA Deployment Infrastructure (HDI) deploy libraryEPSS 0.2%CVE-2024-55159MEDIUMGFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the SortName parameter at /system/loginLog/list.EPSS 0.2%CVE-2026-6638LOWPostgreSQL REFRESH PUBLICATION allows SQL injection via table nameEPSS 0.2%CVE-2026-51936LOWZetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher_export convenience function can be used to copy the contents of one attaEPSS 0.2%CVE-2024-12913HIGHSQLi in Megatek Communication System's Azora Wireless Network ManagementEPSS 0.2%CVE-2026-15829HIGHSQL Injection and Security Boundary Bypass in googleapis/mcp-toolboxEPSS 0.2%CVE-2026-101046LOWFleet before 4.89.0 SQL Injection via ORDER BY Activity EndpointsEPSS 0.2%CVE-2025-6230MEDIUMA SQL injection vulnerability was reported in Lenovo Vantage that could allow a local attacker to modify the local SQLite database and execuEPSS 0.2%CVE-2026-87938—CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136EPSS 0.2%CVE-2026-94348MEDIUMDell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQEPSS 0.2%CVE-2025-52646LOWHCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries.EPSS 0.1%CVE-2026-89303MEDIUMPost Voting System <= 1.0 - Subscriber+ SQLi via 'row' ParameterEPSS 0.1%CVE-2025-55703LOWAn error-based SQL injection vulnerability exists in the Sunbird Power IQ 9.2.0 API. The vulnerability is due to an outdated API endpoint thEPSS 0.1%CVE-2024-14025LOWVideo StationEPSS 0.1%CVE-2025-49211HIGHA SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affectedEPSS 0.1%CVE-2025-49218HIGHA post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges oEPSS 0.1%CVE-2026-11475MEDIUMKushan2k student-management-system Certificate Verification Endpoint GradeController.php getStatus sql injectionEPSS 0.1%CVE-2026-1907HIGHSQL Injection in Clustering Communication (Hybrid Mode)EPSS 0.1%