Sign in Sign up
JA · EN · FR
SecPulse

Cwe 89

🧬 CWE Related 4,154
slug: cwe-89

Explanation

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。 攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。 対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。
📌 Example
Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 4,168

Image ID Title
CVE-2026-28142 SQL Injection in Web Directory Free (CVE-2026-28142)
CVE-2026-28002 SQL Injection in Booktics (CVE-2026-28002)
CVE-2026-28001 SQL Injection in WP Directory Kit (CVE-2026-28001)
CVE-2026-27538 SQL Injection in WP Directory Kit (CVE-2026-27538)
CVE-2026-55072 Vulnerability in pimcore/pimcore (CVE-2026-55072)
CVE-2026-15741 SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as...
CVE-2026-11840 SQL Injection in Zohocorp ManageEngine Password Manager Pro (CVE-2026-11840)
CVE-2026-73331 SQL Injection in CamaleonCMS (CVE-2026-73331)
CVE-2026-73332 SQL Injection in CamaleonCMS (CVE-2026-73332)
CVE-2026-72807 SQL Injection in github.com/siyuan-note/siyuan/kernel (CVE-2026-72807)
CVE-2026-67579 SQL Injection in Ash Hq (CVE-2026-67579)
CVE-2026-17111 SQL Injection in IBM i (CVE-2026-17111)
CVE-2026-17419 SQL Injection in IBM i (CVE-2026-17419)
CVE-2026-17418 SQL Injection in IBM i (CVE-2026-17418)
CVE-2026-17222 SQL Injection in IBM i (CVE-2026-17222)
CVE-2026-73300 SQL Injection in @budibase/server (CVE-2026-73300)
CVE-2026-47132 Vulnerability in thorsten/phpmyfaq (CVE-2026-47132)
CVE-2026-32593 SQL Injection in winter/wn-backend-module (CVE-2026-32593)
CVE-2025-41771 An authenticated attacker with low privileges can access an endpoint in the controller’s web...
CVE-2026-66659 SQL Injection in Tablesome Table (CVE-2026-66659)
CVE-2026-16977 SQL Injection in Form Maker by (WordPress plugin) (CVE-2026-16977)
CVE-2026-18474 SQL Injection in WP Directory Kit (WordPress plugin) (CVE-2026-18474)
CVE-2026-18057 SQL Injection in Events Manager (WordPress plugin) (CVE-2026-18057)
CVE-2026-18230 SQL Injection in WP Directory Kit (WordPress plugin) (CVE-2026-18230)
CVE-2026-13613 SQL Injection in KiviCare (WordPress plugin) (CVE-2026-13613)
CVE-2026-73211 SQL Injection in PeerTube (CVE-2026-73211)
CVE-2026-48381 SQL Injection in Adobe Campaign Classic (CVE-2026-48381)
CVE-2016-20097 SQL Injection in SignatureDownLoad servlet (CVE-2016-20097)
CVE-2022-50997 Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the...
CVE-2026-65673 SQL Injection in Microsoft Entra Connect (CVE-2026-65673)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details