Sign in Sign up
JA · EN · FR
SecPulse

Cwe 89

🧬 CWE Related 4,188
slug: cwe-89

Explanation

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。 攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。 対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。
📌 Example
Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。
🔗 Related links

🔖 Related tags

Cwe 798783 Cwe 8624077 Cwe 2844037 Cwe 4163898 Cwe 1193186 Cwe 2003160 Cwe 1253129 Cwe 202861 Cwe 222781 Cwe 7872527 Cwe 782043 Cwe 941886 Cwe 8631885 Cwe 741810 Cwe 1221802

🛡 Vulnerabilities tagged with this 4,343

Image ID Title
CVE-2026-34612 SQL Injection in Kestra (CVE-2026-34612)
CVE-2026-27834 SQL Injection in Piwigo (CVE-2026-27834)
CVE-2026-27885 SQL Injection in Piwigo (CVE-2026-27885)
CVE-2026-27634 SQL Injection in Piwigo (CVE-2026-27634)
CVE-2026-25773 SQL Injection in github.com/mattermost/focalboard (CVE-2026-25773)
CVE-2026-5368 Vulnerability in projectworlds Car Rental Project (CVE-2026-5368)
CVE-2026-34717 SQL Injection in OpenProject (CVE-2026-34717)
CVE-2026-34825 SQL Injection in @nocobase/plugin-workflow-sql (CVE-2026-34825)
CVE-2026-34400 SQL Injection in alerta-server (CVE-2026-34400)
CVE-2026-5206 Vulnerability in code-projects Simple Gym Management System (CVE-2026-5206)
CVE-2026-30520 SQL Injection in SourceCodester Loan Management System (CVE-2026-30520)
CVE-2026-34220 SQL Injection in Mikro Orm (CVE-2026-34220)
CVE-2026-5198 Vulnerability in code-projects Student Membership System (CVE-2026-5198)
CVE-2026-4317 SQL Injection in Umami Software web application (CVE-2026-4317)
CVE-2026-27876 Code Injection in grafana (CVE-2026-27876)
CVE-2026-24031 SQL Injection in Dovecot (CVE-2026-24031)
CVE-2026-33531 SQL Injection in InvenTree (CVE-2026-33531)
CVE-2026-30463 SQL Injection in Fuel Cms (CVE-2026-30463)
CVE-2026-23921 SQL Injection in Zabbix (CVE-2026-23921)
CVE-2025-41008 SQL Injection in Sinturno (CVE-2025-41008)
CVE-2025-41007 SQL Injection in Cuantis. This vulnerability allows an attacker to retrieve, create, update and delete databases…
CVE-2019-25578 SQL Injection in phpTransformer (CVE-2019-25578)
CVE-2026-33142 SQL Injection in OneUptime (CVE-2026-33142)
CVE-2026-4324 SQL Injection in katello (CVE-2026-4324)
CVE-2025-62319 SQL Injection in Hcltech (CVE-2025-62319)
CVE-2026-32306 SQL Injection in OneUptime (CVE-2026-32306)
CVE-2026-21708 SQL Injection in Veeam Backup Replication (CVE-2026-21708)
CVE-2026-31844 SQL Injection in Koha (CVE-2026-31844)
CVE-2026-30951 SQL Injection in Sequelize is a Node.js ORM tool. Prior to (CVE-2026-30951)
CVE-2026-3843 SQL Injection in Linux Nefteprodukttekhnika BUK TS-G Gas Station Automation System (CVE-2026-3843)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details