Sign in Sign up
JA · EN · FR
SecPulse

Cwe 89

🧬 CWE Related 4,154
slug: cwe-89

Explanation

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。 攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。 対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。
📌 Example
Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 4,162

Image ID Title
CVE-2026-16482 SQL Injection in rtMedia for WordPress, BuddyPress and bbPress (WordPress plugin) (CVE-2026-16482)
CVE-2026-84047 SQL Injection in Album Cover Finder (WordPress plugin) (CVE-2026-84047)
CVE-2026-80491 SQL Injection in SAMO Forms (WordPress plugin) (CVE-2026-80491)
CVE-2026-52630 SQL Injection in Woltlab WCF v.6.2.4 and (CVE-2026-52630)
CVE-2026-62112 SQL Injection in Amelia (CVE-2026-62112)
CVE-2026-62109 Editor SQL Injection in Sky Addons for Elementor <= 3.8.4 versions.
CVE-2026-72708 SQL Injection in SPIP (CVE-2026-72708)
CVE-2026-15439 SQL Injection in GamiPress (WordPress plugin) (CVE-2026-15439)
CVE-2026-82583 SQL Injection in NextGen Connect (CVE-2026-82583)
CVE-2026-15462 SQL Injection in Sticky Chat Widget (WordPress plugin) (CVE-2026-15462)
CVE-2026-18561 SQL Injection in Unlimited Elements For Elementor (WordPress plugin) (CVE-2026-18561)
CVE-2026-89089 A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple...
CVE-2026-73698 SQL Injection in FileRun (CVE-2026-73698)
CVE-2026-81800 Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions.
CVE-2026-88890 OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter...
CVE-2026-38626 SQL Injection in Garlic-Hub (CVE-2026-38626)
CVE-2026-9163 SQL Injection in GisLab Laboratory Management System (CVE-2026-9163)
CVE-2026-78082 Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map...
CVE-2026-7188 SQL Injection in Armiya Information Technologies Ltd (CVE-2026-7188)
CVE-2026-87925 Vulnerability in Rizwan17 inventory-management-system (CVE-2026-87925)
CVE-2026-87921 Vulnerability in Rizwan17 inventory-management-system (CVE-2026-87921)
CVE-2026-79387 SQL Injection in PbootCMS (CVE-2026-79387)
CVE-2026-71808 SQL Injection in Siam Ordering (siam-server) (CVE-2026-71808)
CVE-2026-79322 SQL Injection in Mageplaza (CVE-2026-79322)
CVE-2026-79947 SQL Injection in Dell SCG (CVE-2026-79947)
CVE-2026-67401 A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root...
CVE-2026-78482 SQL Injection in Dell SCG (CVE-2026-78482)
CVE-2026-87807 SQL Injection in siyuan (CVE-2026-87807)
CVE-2026-79972 SQL Injection in Dell SCG (CVE-2026-79972)
CVE-2026-79640 SQL Injection in Dell SCG (CVE-2026-79640)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details