<p>Web applications are frequently targeted by various penetration attacks, among which injection attacks are particularly prominent due to their destructive nature, attracting widespread attention. Existing static analysis techniques often suffer from low efficiency and high false positive rates, especially when dealing with the complex interprocedural dependencies and taint propagation paths found in Java web applications. In contrast, dynamic analysis methods tend to overlook vulnerabilities due to limited code path coverage and reliance on specific execution environments. These limitations highlight the need for a more robust detection framework capable of accurately capturing global data flows and semantic features across methods and classes. In this paper, we propose WIVIM (Web Injection Vulnerability Detection based on Interprocedural Analysis and MiniLM-GNN), a framework specifically designed for Java web applications. WIVIM integrates static analysis, taint analysis, code embedding techniques, and graph neural networks to identify injection vulnerabilities. It first extracts a System Dependence Graph (SDG) from the source code. Then, it slices and reconstructs the SDG based on the flow of tainted variables to generate subgraphs representing potential vulnerability contexts. These subgraphs are encoded using a language model to capture semantic representations of Java codes. Finally, nodes are fed into a graph neural network for classification. Experimental results demonstrate that WIVIM achieves a binary classification accuracy of 95.43%, validating its effectiveness. Furthermore, WIVIM exhibits strong performance in multiclass vulnerability detection.</p>