Weaknesses of type CWE-89

12,811 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2022-39323HIGHSQL Injection on REST API in GLPIEPSS 34.5%CVE-2022-0349—NotificationX < 2.3.9 - Unauthenticated Blind SQL InjectionEPSS 34.4%CVE-2021-36300MEDIUMiDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability. An unauthenticated remote attacker may potentially eEPSS 33.3%CVE-2023-30194CRITICALPrestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook().EPSS 32.4%CVE-2025-24587HIGHWordPress Email Subscription Popup plugin <= 1.2.23 - SQL Injection vulnerabilityEPSS 32.2%CVE-2023-4548MEDIUMSPA-Cart eCommerce CMS GET Parameter search sql injectionEPSS 32.2%CVE-2022-0651CRITICALWP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_typeEPSS 32.2%CVE-2024-30491HIGHWordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - SQL Injection vulnerabilityEPSS 32.0%CVE-2023-41320HIGHAccount takeover via SQL Injection in UI layout preferences in GLPIEPSS 31.9%CVE-2023-4708MEDIUMInfosoftbd Clcknshop GET Parameter all sql injectionEPSS 31.2%CVE-2023-43813MEDIUMglpi Authenticated SQL InjectionEPSS 30.9%CVE-2025-29085CRITICALSQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/eEPSS 30.7%CVE-2024-31077HIGHForminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authenticated attacker with EPSS 30.4%CVE-2021-20028CRITICALImproper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, sEPSS 30.1%KEVCVE-2021-24340—WP Statistics < 13.0.8 - Unauthenticated SQL InjectionEPSS 29.8%CVE-2020-13568HIGHSQL injection vulnerability exists in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HEPSS 29.7%CVE-2021-36299HIGHDell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability. A remote authenticEPSS 29.6%CVE-2024-39907CRITICALa sqlinjection in 1Panel EPSS 29.2%CVE-2023-34991CRITICALA improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and EPSS 28.8%CVE-2022-3323HIGHAn SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listEPSS 28.6%