Sign in Sign up
JA · EN · FR
SecPulse

Cwe 89

🧬 CWE Related 4,188
slug: cwe-89

Explanation

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。 攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。 対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。
📌 Example
Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。
🔗 Related links

🔖 Related tags

Cwe 798783 Cwe 8624077 Cwe 2844037 Cwe 4163898 Cwe 1193186 Cwe 2003160 Cwe 1253129 Cwe 202861 Cwe 222781 Cwe 7872527 Cwe 782043 Cwe 941886 Cwe 8631885 Cwe 741810 Cwe 1221802

🛡 Vulnerabilities tagged with this 4,343

Image ID Title
CVE-2026-35221 SQL Injection in joomla (CVE-2026-35221)
CVE-2026-35222 SQL Injection in joomla (CVE-2026-35222)
CVE-2025-36220 SQL Injection in IBM Cloud Pak for Data System - Cyclops (CVE-2025-36220)
CVE-2026-9552 Vulnerability in Das Parking Management System 停车场管理系统 (CVE-2026-9552)
CVE-2026-9551 Vulnerability in Das Parking Management System 停车场管理系统 (CVE-2026-9551)
CVE-2026-42425 SQL Injection in OpenKM (CVE-2026-42425)
CVE-2026-9542 Vulnerability in CodeAstro Leave Management System (CVE-2026-9542)
CVE-2026-9544 A vulnerability was found in Shenzhen Sixun Software Sixun Shanghui Group Business Management...
CVE-2026-48136 When Compliance is enabled on Check Point Multi-Domain Management, an authenticated administrator...
CVE-2026-48134 SQL Injection in UserChoice flow (CVE-2026-48134)
CVE-2026-9526 Vulnerability in itsourcecode Electronic Judging System (CVE-2026-9526)
CVE-2026-9528 Vulnerability in itsourcecode Electronic Judging System (CVE-2026-9528)
CVE-2026-9525 Vulnerability in itsourcecode Electronic Judging System (CVE-2026-9525)
CVE-2026-9524 Vulnerability in xianrendzw EasyReport (CVE-2026-9524)
CVE-2026-9523 A vulnerability was detected in Acrel Electrical EEMS Enterprise Power Operation and Maintenance...
CVE-2026-48837 SQL Injection in Unlimited Elements For Elementor (CVE-2026-48837)
CVE-2026-42774 SQL Injection in JetEngine (CVE-2026-42774)
CVE-2026-42773 SQL Injection in eMagicOne Store Manager (CVE-2026-42773)
CVE-2026-48842 SQL Injection in Roundcube Webmail (CVE-2026-48842)
CVE-2026-9474 Vulnerability in yashpokharna2555 StudentManagementSystem (CVE-2026-9474)
CVE-2026-9470 Vulnerability in yashpokharna2555 StudentManagementSystem (CVE-2026-9470)
CVE-2026-9469 Vulnerability in yashpokharna2555 StudentManagementSystem (CVE-2026-9469)
CVE-2026-27768 SQL Injection affecting the Access Manager role.
CVE-2026-9465 Vulnerability in Tiandy Easy7 Integrated Management Platform (CVE-2026-9465)
CVE-2018-25380 SQL Injection in Joomla Component eXtroForms (CVE-2018-25380)
CVE-2018-25381 SQL Injection in Joomla Responsive Portfolio (CVE-2018-25381)
CVE-2018-25379 SQL Injection in Collectric CMU (CVE-2018-25379)
CVE-2018-25372 SQL Injection in MedDream PACS Server Premium (CVE-2018-25372)
CVE-2018-25371 mooSocial Store Plugin 2.6 contains a blind SQL injection vulnerability that allows...
CVE-2018-25362 SQL Injection in Twitter-Clone (CVE-2018-25362)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details