Weaknesses of type CWE-89

11,946 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2018-25403HIGHThe Open ISES Project 3.30A SQL Injection via city_graph.phpEPSS 0.3%CVE-2018-25342HIGHSmartshop 1 SQL Injection via search.phpEPSS 0.3%CVE-2025-15143MEDIUMEyouCMS Backend Template Management FilemanagerLogic.php sql injectionEPSS 0.3%CVE-2018-25394HIGHKados R10 GreenBee SQL Injection via update_release.phpEPSS 0.3%CVE-2018-25341HIGHSmartshop 1 SQL Injection via product.php id ParameterEPSS 0.3%CVE-2025-0214LOWTMD Custom Header Menu index.php sql injectionEPSS 0.3%CVE-2018-25402HIGHThe Open ISES Project 3.30A SQL Injection via inc_types_graph.phpEPSS 0.3%CVE-2018-25386HIGHHaPe PKH 1.1 SQL Injection via id Parameter in admin/media.phpEPSS 0.3%CVE-2025-13811MEDIUMjsnjfz WebStack-Guns PageFactory.java sql injectionEPSS 0.3%CVE-2018-25385HIGHE-Registrasi Pencak Silat 18.10 SQL Injection via id_partaiEPSS 0.3%CVE-2025-5487HIGHAutomatorWP <= 5.2.5 - Authenticated (Administrator+) SQL Injection via field_conditionsEPSS 0.3%CVE-2019-25486HIGHVarient 1.6.1 SQL Injection via user_id ParameterEPSS 0.3%CVE-2018-25390HIGHHaPe PKH 1.1 SQL Injection via desa ParameterEPSS 0.3%CVE-2026-6929HIGHJoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' ParameterEPSS 0.3%CVE-2019-25640HIGHInout Article Base CMS Lastest SQL Injection via portalLogin.phpEPSS 0.3%CVE-2018-25401HIGHThe Open ISES Project 3.30A SQL Injection via sever_graph.phpEPSS 0.3%CVE-2024-44906MEDIUMuptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go. The maintEPSS 0.3%CVE-2018-25382HIGHZechat 1.5 SQL Injection via uname ParameterEPSS 0.3%CVE-2026-13333MEDIUMGroundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' ParameterEPSS 0.3%CVE-2026-40083HIGHCacti: SQL Injection in managers.phpEPSS 0.3%