Sign in Sign up
JA · EN · FR
SecPulse

Cwe 89

🧬 CWE Related 4,154
slug: cwe-89

Explanation

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。 攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。 対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。
📌 Example
Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 4,154

Image ID Title
CVE-2025-71428 SQL Injection in Jivejdon (CVE-2025-71428)
CVE-2026-16830 SQL Injection in IBM Security Verify Access (CVE-2026-16830)
CVE-2026-107385 SQL Injection in mariadb (CVE-2026-107385)
CVE-2026-107384 SQL Injection in mariadb (CVE-2026-107384)
CVE-2026-107375 SQL Injection in generator-jhipster (CVE-2026-107375)
CVE-2026-105076 SQL Injection in Vitepos (CVE-2026-105076)
CVE-2026-12260 SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ...
CVE-2026-5048 SQL Injection in Brocade SANnav (CVE-2026-5048)
CVE-2026-76270 SQL Injection in Splunk Enterprise (CVE-2026-76270)
CVE-2026-95605 SQL Injection in WP Data Access (CVE-2026-95605)
CVE-2026-76452 SQL Injection in Cisco License On-Prem (CVE-2026-76452)
CVE-2026-62251 SQL Injection in github.com/sipcapture/homer-app (CVE-2026-62251)
CVE-2026-42710 SQL Injection in Slider by (CVE-2026-42710)
CVE-2026-42708 SQL Injection in WP Post Author (CVE-2026-42708)
CVE-2026-42714 SQL Injection in Pix por Piggly (CVE-2026-42714)
CVE-2026-42713 SQL Injection in Post title marquee scroll (CVE-2026-42713)
CVE-2026-103668 SQL Injection in Movable Type (CVE-2026-103668)
CVE-2026-42721 SQL Injection in affiliate-toolkit (CVE-2026-42721)
CVE-2026-42720 SQL Injection in Dynamic User Directory (CVE-2026-42720)
CVE-2026-102782 Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7...
CVE-2026-107103 SQL Injection in ERP system (CVE-2026-107103)
CVE-2026-104667 SQL Injection in Animated Number Counters (WordPress plugin) (CVE-2026-104667)
CVE-2026-104953 SQL Injection in MPG (WordPress plugin) (CVE-2026-104953)
CVE-2026-79811 SQL Injection in ClearPass Policy Manager (CVE-2026-79811)
CVE-2026-79798 SQL Injection in ClearPass Policy Manager (CVE-2026-79798)
CVE-2026-79794 SQL Injection in ClearPass Policy Manager (CVE-2026-79794)
CVE-2025-45871 SQL Injection in LogicalDOC Enterprise (CVE-2025-45871)
CVE-2026-105957 Vulnerability in SourceCodester Performance Indicator System (CVE-2026-105957)
CVE-2026-105856 SQL Injection in @payloadcms/db-sqlite (CVE-2026-105856)
CVE-2026-105845 SQL Injection in payload (CVE-2026-105845)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details