Sign in Sign up
JA · EN · FR
SecPulse

Cwe 89

🧬 CWE Related 4,188
slug: cwe-89

Explanation

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。 攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。 対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。
📌 Example
Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。
🔗 Related links

🔖 Related tags

Cwe 798783 Cwe 8624077 Cwe 2844037 Cwe 4163898 Cwe 1193186 Cwe 2003160 Cwe 1253129 Cwe 202861 Cwe 222781 Cwe 7872527 Cwe 782043 Cwe 941886 Cwe 8631885 Cwe 741810 Cwe 1221802

🛡 Vulnerabilities tagged with this 4,343

Image ID Title
CVE-2026-48240 SQL Injection in Open ISES Tickets (CVE-2026-48240)
CVE-2026-48238 SQL Injection in Open ISES Tickets (CVE-2026-48238)
CVE-2026-48232 SQL Injection in Open ISES Tickets (CVE-2026-48232)
CVE-2026-48233 SQL Injection in Open ISES Tickets (CVE-2026-48233)
CVE-2026-48234 SQL Injection in Open ISES Tickets (CVE-2026-48234)
CVE-2026-48231 SQL Injection in Open ISES Tickets (CVE-2026-48231)
CVE-2026-39531 SQL Injection in WP Directory Kit (CVE-2026-39531)
CVE-2026-44047 SQL Injection in Netatalk (CVE-2026-44047)
CVE-2026-9082 KEV [KEV] SQL Injection in Drupal Core (CVE-2026-9082)
CVE-2026-44923 SQL Injection in InfoScale VIOM (CVE-2026-44923)
CVE-2026-42383 SQL Injection in YITH WooCommerce Product Add-Ons (CVE-2026-42383)
CVE-2026-9065 SQL Injection in WordPress SureCart (CVE-2026-9065)
CVE-2026-9059 SQL Injection in NextGEN Gallery (CVE-2026-9059)
CVE-2026-9003 E-LAN Hybrid Recording System developed by TONNET has a SQL Injection vulnerability, allowing...
CVE-2026-9010 SQL Injection in Boost (WordPress plugin) (CVE-2026-9010)
CVE-2026-8685 SQL Injection in Infility Global (WordPress plugin) (CVE-2026-8685)
CVE-2026-7472 SQL Injection in Read More & Accordion (WordPress plugin) (CVE-2026-7472)
CVE-2026-3985 SQL Injection in WordPress (CVE-2026-3985)
CVE-2026-31069 SQL Injection in billabear/billabear (CVE-2026-31069)
CVE-2026-8912 SQL Injection in Contest Gallery (WordPress plugin) (CVE-2026-8912)
CVE-2026-8726 SQL Injection in georgringer/news (CVE-2026-8726)
CVE-2026-8827 SQL Injection in friendsoftypo3/tt-address (CVE-2026-8827)
CVE-2026-8851 SQL Injection in SOGo (CVE-2026-8851)
CVE-2026-6379 SQL Injection in WP Photo Album Plus (WordPress plugin) (CVE-2026-6379)
CVE-2026-8785 Vulnerability in projectworlds hospital-management-system-in-php (CVE-2026-8785)
CVE-2026-8771 Vulnerability in org.linlinjava:litemall-wx-api (CVE-2026-8771)
CVE-2026-8772 Vulnerability in linlinjava litemall (CVE-2026-8772)
CVE-2018-25338 SQL Injection in Zechat (CVE-2018-25338)
CVE-2018-25339 SQL Injection in Zechat (CVE-2018-25339)
CVE-2018-25330 Joomla! extension EkRishta 2.10 contains persistent cross-site scripting and SQL injection...

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details