Weaknesses of type CWE-89

12,006 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2024-34993MEDIUMIn the module "Bulk Export products to Google Merchant-Google Shopping" (bagoogleshopping) up to version 1.0.26 from Buy Addons for PrestaShEPSS 0.3%CVE-2025-39386CRITICALWordPress Hospital Management System plugin <= 47.0(20-11-2023) - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-47640CRITICALWordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.4.0 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-25514MEDIUMSeacms <=13.3 is vulnerable to SQL Injection in admin_collect_news.php.EPSS 0.3%CVE-2026-12920MEDIUMCookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Administrator+) SQL Injection via 's' ParameterEPSS 0.3%CVE-2026-39502CRITICALWordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-52720CRITICALWordPress Super Store Finder Plugin <= 7.5 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-47599CRITICALWordPress Facturante plugin <= 1.11 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-20272MEDIUMCisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Blind SQL Injection VulnerabilityEPSS 0.3%CVE-2025-54720CRITICALWordPress Nest Addons Plugin <= 1.6.3 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-10762MEDIUMkuaifan DooTask UsersController.php sql injectionEPSS 0.3%CVE-2025-48274CRITICALWordPress WP Job Portal plugin <= 2.3.2 - SQL Injection VulnerabilityEPSS 0.3%CVE-2019-25638HIGHMeeplace Business Review Script Lastest SQL Injection via addclick.phpEPSS 0.3%CVE-2025-12620MEDIUMPoll Maker – Versus Polls, Anonymous Polls, Image Polls <= 6.0.7 - Authenticated (Administrator+) SQL Injection via `filterbyauthor` ParameterEPSS 0.3%CVE-2025-13385MEDIUMBookme <= 4.2 - Authenticated (Admin+) SQL Injection via 'filter[status]' ParameterEPSS 0.3%CVE-2024-49588MEDIUMMultiple authenticated SQL injections in oracle-sidecarEPSS 0.3%CVE-2025-52830CRITICALWordPress bSecure – Your Universal Checkout plugin <= 1.7.9 - SQL Injection VulnerabilityEPSS 0.3%CVE-2024-30872MEDIUMnetentsec NS-ASG 6.3 is vulnerable to SQL Injection via /include/authrp.php.EPSS 0.3%CVE-2025-68055HIGHWordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-32418HIGHWordPress Meow Gallery plugin <= 5.4.4 - SQL Injection vulnerabilityEPSS 0.3%