Sign in Sign up
JA · EN · FR
SecPulse

Cwe 89

🧬 CWE Related 4,188
slug: cwe-89

Explanation

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。 攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。 対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。
📌 Example
Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。
🔗 Related links

🔖 Related tags

Cwe 798783 Cwe 8624077 Cwe 2844037 Cwe 4163898 Cwe 1193186 Cwe 2003160 Cwe 1253129 Cwe 202861 Cwe 222781 Cwe 7872527 Cwe 782043 Cwe 941886 Cwe 8631885 Cwe 741810 Cwe 1221802

🛡 Vulnerabilities tagged with this 4,343

Image ID Title
CVE-2026-42475 SQL Injection in MixPHP Framework 2.x thru (CVE-2026-42475)
CVE-2026-37505 SQL Injection in V2Board (CVE-2026-37505)
CVE-2026-3346 SQL Injection in Langflow (CVE-2026-3346)
CVE-2026-3325 SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” parameter of the…
CVE-2026-42167 SQL Injection in ProFTPD (CVE-2026-42167)
CVE-2026-7206 Vulnerability in sqlite-mcp (CVE-2026-7206)
CVE-2026-7196 Vulnerability in CodeAstro Online Classroom (CVE-2026-7196)
CVE-2026-7199 Vulnerability in SourceCodester Pharmacy Sales and Inventory System (CVE-2026-7199)
CVE-2026-7194 Vulnerability in SourceCodester Pharmacy Sales and Inventory System (CVE-2026-7194)
CVE-2025-50229 SQL Injection in Jizhicms (CVE-2025-50229)
CVE-2026-6887 Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a SQL Injection vulnerability…
CVE-2026-29198 SQL Injection in Rocketchat (CVE-2026-29198)
CVE-2026-41640 SQL Injection in @nocobase/database (CVE-2026-41640)
CVE-2026-41457 SQL Injection in OwnTone Server (CVE-2026-41457)
CVE-2026-40906 SQL Injection in Electric (CVE-2026-40906)
CVE-2025-70420 SQL Injection in Genesys Latitude (CVE-2025-70420)
CVE-2025-41029 SQL Injection in Zeon Academy Pro by Zeon Global Tech (CVE-2025-41029)
CVE-2025-66335 SQL Injection in doris-mcp-server (CVE-2025-66335)
CVE-2026-5963 SQL Injection in Digiwin (CVE-2026-5963)
CVE-2026-5964 SQL Injection in Digiwin (CVE-2026-5964)
CVE-2025-15625 SQL Injection in Sparxsystems (CVE-2025-15625)
CVE-2025-63029 SQL Injection in WCFM Marketplace (CVE-2025-63029)
CVE-2026-33714 SQL Injection in Chamilo (CVE-2026-33714)
CVE-2026-32176 SQL Injection in SQL Server (CVE-2026-32176)
CVE-2025-61848 SQL Injection in Fortinet Fortimanager (CVE-2025-61848)
CVE-2026-36942 SQL Injection in Sourcecodester Online Resort Management System (CVE-2026-36942)
CVE-2026-36946 SQL Injection in Sourcecodester Computer (CVE-2026-36946)
CVE-2026-36874 SQL Injection in Sourcecodester Basic Library System (CVE-2026-36874)
CVE-2025-15441 SQL Injection in Form Maker by (WordPress plugin) (CVE-2025-15441)
CVE-2026-21643 KEV [KEV] SQL Injection in Fortinet forticlient-ems (CVE-2026-21643)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details