Weaknesses of type CWE-89

12,031 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2025-62173HIGHAuthenticated SQL Injection in Endpoint Module Rest APIEPSS 0.3%CVE-2026-57787HIGHWordPress CWS SVGicons plugin <= 1.5.5 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-5148MEDIUMYunaiV yudao-cloud page sql injectionEPSS 0.3%CVE-2026-27039HIGHWordPress WZone plugin <= 14.0.31 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-39495HIGHWordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-13855HIGHIBM Storage Protect Server is affected by a vulnerability that could allow authenticated users to access administrative metadata through the JSON-RPC endpoint .EPSS 0.3%CVE-2026-24977HIGHWordPress Organici Library plugin <= 2.1.2 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-67921HIGHWordPress Lobo theme < 2.8.6 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-7408MEDIUMSourceCodester Pizzafy Ecommerce System ajax.php save_menu sql injectionEPSS 0.3%CVE-2026-7407MEDIUMSourceCodester Pizzafy Ecommerce System Setting ajax.php save_settings sql injectionEPSS 0.3%CVE-2026-57772HIGHWordPress WP Inventory Manager plugin <= 2.4.0 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-25007HIGHWordPress ElementInvader Addons for Elementor plugin <= 1.4.2 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-28969HIGHWordPress Gallery Widget plugin <= 1.2.1 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-30969HIGHWordPress iFrame Images Gallery plugin <= 9.0 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-24780HIGHWordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.4.0 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-63231HIGHPost-authentication SQL injection vulnerabilityEPSS 0.3%CVE-2025-28967HIGHWordPress Contact Us page - Contact people LITE plugin <= 3.7.4 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-33503HIGHOry Kratos has a SQL injection via forged pagination tokensEPSS 0.3%CVE-2026-9272HIGHPossibility of unintended database operations when querying data related to detected anomalies in Progress Flowmon ADSEPSS 0.3%CVE-2026-25234MEDIUMPEAR is Vulnerable to SQL Injection in Category DeletionEPSS 0.3%