Weaknesses of type CWE-89

12,012 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2026-12987HIGHEvents Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking RegistrationEPSS 0.3%CVE-2025-32924HIGHWordPress Revy plugin <= 2.1 - SQL Injection vulnerabilityEPSS 0.3%CVE-2018-25339HIGHZechat 1.5 SQL Injection via v parameter (time-based blind)EPSS 0.3%CVE-2025-32301HIGHWordPress CountDown Pro WP Plugin <= 2.7 - SQL Injection VulnerabilityEPSS 0.3%CVE-2018-25205HIGHASP.NET jVideo Kit 1.0 SQL Injection via query ParameterEPSS 0.3%CVE-2019-25641HIGHNetartmedia Vlog System Lastest SQL Injection via email ParameterEPSS 0.3%CVE-2025-52822HIGHWordPress WP Roadmap plugin <= 2.1.3 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-32306HIGHWordPress Radio Player Shoutcast & Icecast theme <= 4.4.6 - SQL Injection VulnerabilityEPSS 0.3%CVE-2019-25642HIGHBootstrapy CMS Lastest Multiple SQL Injection via Forum and Contact ModulesEPSS 0.3%CVE-2025-5673MEDIUMBlog2Social <= 8.4.4 - Authenticated (Subscriber+) SQL Injection via `prgSortPostType` ParameterEPSS 0.3%CVE-2025-32287HIGHWordPress Responsive HTML5 Audio Player PRO With Playlist plugin <= 3.5.7 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-2122MEDIUMXiaopi Panel WAF Firewall demo.php sql injectionEPSS 0.3%CVE-2025-32307HIGHWordPress Chameleon HTML5 Audio Player With/Without Playlist plugin <= 3.5.6 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-47651HIGHWordPress Infility Global plugin <= 2.15.06 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-31926HIGHWordPress Sticky Radio Player plugin <= 3.4 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-15736HIGHMultiple SQL/DDL Injection and Arbitrary File Read Vulnerabilities in snowflake-sqlalchemyEPSS 0.3%CVE-2025-52821HIGHWordPress Video List Manager plugin <= 1.7 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-39355HIGHWordPress FAT Services Booking plugin <= 5.6 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-32290HIGHWordPress Sticky HTML5 Music Player plugin <= 3.1.6 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-65707HIGHLikeshop 3.0.5 Authenticated SQL Injection via adjustAccount EndpointEPSS 0.3%