Weaknesses of type CWE-89

11,926 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2025-10047MEDIUMEmail Tracker <= 5.3.15 - Authenticated (Admin+) SQL InjectionEPSS 0.3%CVE-2025-32020CRITICALImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in crud-query-parserEPSS 0.3%CVE-2025-11461HIGHFrappe CRM 1.53.1 — Multiple SQL Injections in Dashboard ControllerEPSS 0.3%CVE-2026-15022MEDIUMTutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer ArrayEPSS 0.3%CVE-2025-14011MEDIUMJIZHICMS Add Display Name Field addcomment.html commentlist sql injectionEPSS 0.3%CVE-2026-27768MEDIUMSQL Injection affecting the Access Manager role.EPSS 0.3%CVE-2025-10692HIGHOpenSupports 4.11.0 — SQL InjectionEPSS 0.3%CVE-2026-39318HIGHChurchCRM has a DDL SQL Injection in GroupPropsFormRowOps.phpEPSS 0.3%CVE-2025-24773CRITICALWordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin <= 3.2.0 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-23967CRITICALWordPress GG Bought Together for WooCommerce plugin <= 1.0.2 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-39479CRITICALWordPress Smart Notification Plugin <= 10.3 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-20002HIGHA vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct EPSS 0.3%CVE-2025-6847MEDIUMcode-projects Simple Forum forum_edit.php sql injectionEPSS 0.3%CVE-2025-10218MEDIUMlostvip-com ruoyi-go Background Management SysRoleDao.go SelectListPage sql injectionEPSS 0.3%CVE-2025-5590HIGHOwl carousel responsive <= 1.9 - Authenticated (Contributor+) SQL Injection via id ParameterEPSS 0.3%CVE-2023-44090MEDIUMUnautH SQL InjectionEPSS 0.3%CVE-2026-25936MEDIUMGLPI Vulnerable to Authenticated SQL InjectionEPSS 0.3%CVE-2025-14661MEDIUMitsourcecode Student Managemen System advisers.php sql injectionEPSS 0.3%CVE-2025-14565MEDIUMkidaze CourseSelectionSystem login1.php sql injectionEPSS 0.3%CVE-2025-13210MEDIUMitsourcecode Inventory Management System index.php sql injectionEPSS 0.3%