Sign in Sign up
JA · EN · FR
SecPulse

Cwe 89

🧬 CWE Related 4,188
slug: cwe-89

Explanation

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。 攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。 対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。
📌 Example
Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。
🔗 Related links

🔖 Related tags

Cwe 798783 Cwe 8624077 Cwe 2844037 Cwe 4163898 Cwe 1193186 Cwe 2003160 Cwe 1253129 Cwe 202861 Cwe 222781 Cwe 7872527 Cwe 782043 Cwe 941886 Cwe 8631885 Cwe 741810 Cwe 1221802

🛡 Vulnerabilities tagged with this 4,343

Image ID Title
CVE-2026-48882 SQL Injection in WP Time Slots Booking Form (CVE-2026-48882)
CVE-2026-48874 SQL Injection in GamiPress (CVE-2026-48874)
CVE-2026-48886 SQL Injection in JS Help Desk (CVE-2026-48886)
CVE-2026-45439 Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions.
CVE-2026-42639 SQL Injection in GD Rating System (CVE-2026-42639)
CVE-2026-42665 SQL Injection in WP Data Access (CVE-2026-42665)
CVE-2026-40771 SQL Injection in Contest Gallery (CVE-2026-40771)
CVE-2026-42381 Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions.
CVE-2026-40766 SQL Injection in MasterStudy LMS (CVE-2026-40766)
CVE-2026-40798 Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions.
CVE-2026-42386 Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions.
CVE-2026-39502 Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.
CVE-2026-39530 Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions.
CVE-2026-40762 Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions.
CVE-2026-39492 SQL Injection in WP Maps (CVE-2026-39492)
CVE-2026-39511 SQL Injection in WP Photo Album Plus (CVE-2026-39511)
CVE-2026-39512 SQL Injection in GeoDirectory (CVE-2026-39512)
CVE-2026-39493 SQL Injection in Simply Schedule Appointments (CVE-2026-39493)
CVE-2026-39519 SQL Injection in GeekyBot (CVE-2026-39519)
CVE-2026-39441 Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions.
CVE-2026-24637 SQL Injection in PowerPress Podcasting (CVE-2026-24637)
CVE-2026-50890 SQL Injection in Bernd Bestel grocy (CVE-2026-50890)
CVE-2026-48114 SQL Injection in Metacat (CVE-2026-48114)
CVE-2026-38812 SQL Injection in RuoYi (CVE-2026-38812)
CVE-2026-39196 Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the...
CVE-2026-36670 SQL Injection in OpenSIPS Control Panel (CVE-2026-36670)
CVE-2019-25746 SQL Injection in WordPress Sliced Invoices (CVE-2019-25746)
CVE-2016-20071 SQL Injection in WordPress 404 Redirection Manager plugin (CVE-2016-20071)
CVE-2016-20072 SQL Injection in WordPress BBS e-Franchise (CVE-2016-20072)
CVE-2016-20073 SQL Injection in WordPress Answer My Question (CVE-2016-20073)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details