Sign in Sign up
JA · EN · FR
SecPulse

Cwe 89

🧬 CWE Related 4,188
slug: cwe-89

Explanation

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。 攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。 対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。
📌 Example
Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。
🔗 Related links

🔖 Related tags

Cwe 798783 Cwe 8624077 Cwe 2844037 Cwe 4163898 Cwe 1193186 Cwe 2003160 Cwe 1253129 Cwe 202861 Cwe 222781 Cwe 7872527 Cwe 782043 Cwe 941886 Cwe 8631885 Cwe 741810 Cwe 1221802

🛡 Vulnerabilities tagged with this 4,343

Image ID Title
CVE-2026-44381 SQL Injection in MISP (CVE-2026-44381)
CVE-2026-44418 SQL Injection in EcclesiaCRM is CRM Software for church management. In (CVE-2026-44418)
CVE-2026-39358 SQL Injection in CubeCart (CVE-2026-39358)
CVE-2026-42550 SQL Injection in flightphp/core (CVE-2026-42550)
CVE-2026-22599 SQL Injection in @strapi/content-type-builder (CVE-2026-22599)
CVE-2026-42031 Authorization Flaw in ckan (CVE-2026-42031)
CVE-2026-0242 SQL Injection in Trust Protection Foundation (CVE-2026-0242)
CVE-2020-37226 SQL Injection in Joomla J2 JOBS (CVE-2020-37226)
CVE-2020-37218 SQL Injection in Joomla com_hdwplayer (CVE-2020-37218)
CVE-2020-37224 SQL Injection in Joomla J2 JOBS (CVE-2020-37224)
CVE-2026-4608 SQL Injection in ProfileGrid – User Profiles, Groups and Communities (WordPress plugin) (CVE-2026-4608)
CVE-2026-37429 qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the...
CVE-2026-37428 qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the...
CVE-2026-4798 SQL Injection in Avada Builder (WordPress plugin) (CVE-2026-4798)
CVE-2026-6929 SQL Injection in WordPress (CVE-2026-6929)
CVE-2026-7619 SQL Injection in WordPress (CVE-2026-7619)
CVE-2026-6888 Successful exploitation of the SQL injection vulnerability could allow a remote authenticated...
CVE-2026-1250 SQL Injection in Court Reservation – Manage Your Court Bookings Online (WordPress plugin) (CVE-2026-1250)
CVE-2026-44864 SQL Injection in Sd Wan (CVE-2026-44864)
CVE-2026-44860 SQL Injection in Sd Wan (CVE-2026-44860)
CVE-2026-44861 SQL Injection in Sd Wan (CVE-2026-44861)
CVE-2026-44862 SQL Injection in Sd Wan (CVE-2026-44862)
CVE-2026-44863 SQL Injection in Sd Wan (CVE-2026-44863)
CVE-2025-53681 SQL Injection in Fortinet FortiMail (CVE-2025-53681)
CVE-2026-25088 SQL Injection in Fortinet FortiNDR (CVE-2026-25088)
CVE-2026-44204 Vulnerability in Shelf (CVE-2026-44204)
CVE-2026-34187 SQL Injection in Pandora FMS (CVE-2026-34187)
CVE-2026-8111 SQL Injection in Ivanti Endpoint Manager (CVE-2026-8111)
CVE-2026-43937 Vulnerability in YAFNET.Core (CVE-2026-43937)
CVE-2026-32687 SQL Injection in postgrex (CVE-2026-32687)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details