Weaknesses of type CWE-89

11,960 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2025-67830CRITICALMura before 10.1.14 allows beanFeed.cfc getQuery sortby SQL injection.EPSS 0.3%CVE-2026-39196CRITICALDatadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_query parameter in the KeyPartitioner::paEPSS 0.3%CVE-2025-15210MEDIUMcode-projects Refugee Food Management System editrefugee.php sql injectionEPSS 0.3%CVE-2025-7714HIGHTime Based SQLi in Global Medya's PHP CMSEPSS 0.3%CVE-2025-55732HIGHFrappe has the possibility of SQL Injection due to improper validationsEPSS 0.3%CVE-2026-40813HIGHUnauthenticated SQLi in getLiveValuesEPSS 0.3%CVE-2026-40810HIGHUnauthenticated SQLi in userinfo EndpointEPSS 0.3%CVE-2026-40817HIGHUnauthenticated SQLi in getAlarmProfiles functionEPSS 0.3%CVE-2025-5103MEDIUMUltimate Gift Cards for WooCommerce <= 3.1.4 - Authenticated (Administrator+) SQL Injection via wps_wgm_save_post FunctionEPSS 0.3%CVE-2025-14966MEDIUMFastAdmin Backend Controller Backend.php selectpage sql injectionEPSS 0.3%CVE-2026-40818HIGHUnauthenticated SQLi in _mb24confi_getDevice function functionEPSS 0.3%CVE-2018-25424HIGHGate Pass Management System 2.1 SQL Injection via login-exec.phpEPSS 0.3%CVE-2026-37347CRITICALSourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_employee.php.EPSS 0.3%CVE-2026-40815HIGHUnauthenticated SQLi in _mb24api_getUserAccount functionEPSS 0.3%CVE-2025-50466HIGHOpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestEPSS 0.3%CVE-2025-10437CRITICALSQLi in Exagate's Webpack Management SystemEPSS 0.3%CVE-2026-40811HIGHUnauthenticated SQLi in ssoabstractserviceEPSS 0.3%CVE-2026-27847CRITICALMissing authentication in Linksys MR9600, Linksys MX4200EPSS 0.3%CVE-2026-40814HIGHUnauthenticated SQLi in _mb24confi_getTagAlarm functionEPSS 0.3%CVE-2026-40819HIGHUnauthenticated SQLi in sync_data24 taskEPSS 0.3%