Cwe 89

🧬 CWE Related 4,188

slug: cwe-89

Explanation

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。

📌 Example

Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。

🔗 Related links

🔖 Related tags

Cwe 798783 Cwe 8624077 Cwe 2844037 Cwe 4163898 Cwe 1193186 Cwe 2003160 Cwe 1253129 Cwe 202861 Cwe 222781 Cwe 7872527 Cwe 782043 Cwe 941886 Cwe 8631885 Cwe 741810 Cwe 1221802

🛡 Vulnerabilities tagged with this 4,343

ID	Title	Severity	Detected
CVE-2026-40836	An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	4 months ago
CVE-2026-40832	An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	Medium	4 months ago
CVE-2026-40837	An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	Medium	4 months ago
CVE-2026-40816	An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	4 months ago
CVE-2026-40814	An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	4 months ago
CVE-2026-40817	An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	4 months ago
CVE-2026-40821	A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	Medium	4 months ago
CVE-2026-40826	A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	Medium	4 months ago
CVE-2026-40818	An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	4 months ago
CVE-2026-40815	An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	4 months ago
CVE-2026-40824	A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	Medium	4 months ago
CVE-2026-7618	SQL Injection in EnvíaloSimple: Email Marketing y Newsletters (WordPress plugin) (CVE-2026-7618)	Medium	4 months ago
CVE-2026-40822	A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	Medium	4 months ago
CVE-2026-40819	An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	4 months ago
CVE-2026-40823	A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	Medium	4 months ago
CVE-2026-40825	A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	Medium	4 months ago
CVE-2026-40812	An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	4 months ago
CVE-2026-40811	An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	4 months ago
CVE-2026-40810	An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	4 months ago
CVE-2026-40813	An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	4 months ago
CVE-2026-44741	SQL Injection in pimcore/admin-ui-classic-bundle (CVE-2026-44741)	High	4 months ago
CVE-2026-44739	SQL Injection in pimcore/pimcore (CVE-2026-44739)	High	4 months ago
CVE-2026-9607	Vulnerability in itsourcecode Courier Management System (CVE-2026-9607)	Medium	4 months ago
CVE-2026-9606	Vulnerability in itsourcecode Courier Management System (CVE-2026-9606)	High	4 months ago
CVE-2026-9584	Vulnerability in code-projects Project Management System (CVE-2026-9584)	High	4 months ago
CVE-2026-9573	Vulnerability in itsourcecode Student Transcript Processing System (CVE-2026-9573)	High	4 months ago
CVE-2026-9574	Vulnerability in itsourcecode Student Transcript Processing System (CVE-2026-9574)	High	4 months ago
CVE-2026-9575	Vulnerability in itsourcecode Student Transcript Processing System (CVE-2026-9575)	High	4 months ago
CVE-2026-46624	OS Command Injection in Twenty (CVE-2026-46624)	Critical	4 months ago
CVE-2026-44706	SQL Injection in Chatwoot (CVE-2026-44706)	High	4 months ago