Weaknesses of type CWE-89

12,874 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2024-37906CRITICALAdmidio has Blind SQL Injection in ecard_send.phpEPSS 0.9%CVE-2024-29303CRITICALThe delete admin users function of SourceCodester PHP Task Management System 1.0 is vulnerable to SQL InjectionEPSS 0.9%CVE-2023-33331HIGHWordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to SQL InjectionEPSS 0.9%CVE-2024-10845MEDIUM1000 Projects Bookstore Management System book_detail.php sql injectionEPSS 0.9%CVE-2023-0917HIGHSourceCodester Simple Customer Relationship Management System login.php sql injectionEPSS 0.9%CVE-2023-41891LOWFlyteAdmin SQL Injection in List FiltersEPSS 0.9%CVE-2024-10844MEDIUM1000 Projects Bookstore Management System search.php sql injectionEPSS 0.9%CVE-2021-43830HIGHSQL injection in OpenProjectEPSS 0.9%CVE-2020-5320CRITICALDell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a SQLEPSS 0.9%CVE-2023-24840HIGHHGiga MailSherlock - SQL InjectionEPSS 0.9%CVE-2023-4188CRITICALSQL Injection in instantsoft/icms2EPSS 0.9%CVE-2024-32369MEDIUMSQL Injection vulnerability in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a remote attacker to obtain sensitive inforEPSS 0.9%CVE-2022-30998CRITICALWordPress Homepage Product Organizer for WooCommerce plugin <= 1.1 - Multiple Authenticated SQL Injection (SQLi) vulnerabilitiesEPSS 0.9%CVE-2022-47865CRITICALLead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeOrder.php.EPSS 0.9%CVE-2021-32474—An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this reEPSS 0.9%CVE-2023-28663HIGHThe Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injection vulnerability in the ‘fieldmap’ paramEPSS 0.9%CVE-2025-5298MEDIUMCampcodes Online Hospital Management System betweendates-detailsreports.php sql injectionEPSS 0.9%CVE-2022-47861CRITICALLead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeLead.php.EPSS 0.9%CVE-2023-31433HIGHA SQL injection issue in Logbuch in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 allows authenticated attackers to execute SQLEPSS 0.9%CVE-2022-47770CRITICALSerenissima Informatica Fast Checkin version v1.0 is vulnerable to Unauthenticated SQL Injection.EPSS 0.9%