Sign in Sign up
JA · EN · FR
SecPulse

Cwe 89

🧬 CWE Related 4,188
slug: cwe-89

Explanation

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。 攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。 対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。
📌 Example
Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。
🔗 Related links

🔖 Related tags

Cwe 798783 Cwe 8624077 Cwe 2844037 Cwe 4163898 Cwe 1193186 Cwe 2003160 Cwe 1253129 Cwe 202861 Cwe 222781 Cwe 7872527 Cwe 782043 Cwe 941886 Cwe 8631885 Cwe 741810 Cwe 1221802

🛡 Vulnerabilities tagged with this 4,343

Image ID Title
CVE-2025-56421 SQL Injection in LimeSurvey (CVE-2025-56421)
CVE-2025-40639 SQL Injection in Sbitsoft (CVE-2025-40639)
CVE-2018-25197 SQL Injection in PlayJoom (CVE-2018-25197)
CVE-2018-25196 SQL Injection in ServerZilla (CVE-2018-25196)
CVE-2018-25163 SQL Injection in BitZoom (CVE-2018-25163)
CVE-2026-20002 SQL Injection in Cisco Secure FMC Software (CVE-2026-20002)
CVE-2026-20003 SQL Injection in Cisco Secure FMC Software (CVE-2026-20003)
CVE-2026-2584 A critical SQL Injection (SQLi) vulnerability has been identified in the authentication module of the system. An…
CVE-2026-28516 SQL Injection in openDCIM (CVE-2026-28516)
CVE-2025-11252 SQL Injection in windesk.Fm (CVE-2025-11252)
CVE-2025-11251 SQL Injection in E-Commerce Platform (CVE-2025-11251)
CVE-2026-56351 SQL Injection in n8n (CVE-2026-56351)
CVE-2026-25554 SQL Injection in OpenSIPS (CVE-2026-25554)
CVE-2025-10970 SQL Injection in Talentics (CVE-2025-10970)
CVE-2026-26980 SQL Injection in ghost (CVE-2026-26980)
CVE-2025-70152 SQL Injection in Fabian (CVE-2025-70152)
CVE-2025-70149 SQL Injection in CodeAstro Membership Management System (CVE-2025-70149)
CVE-2025-70397 SQL Injection in jizhicms (CVE-2025-70397)
CVE-2025-7631 SQL Injection in Tumeva News Software (CVE-2025-7631)
CVE-2025-10969 SQL Injection in E-Commerce Package (CVE-2025-10969)
CVE-2024-43468 KEV [KEV] SQL Injection in Microsoft Configuration Manager (CVE-2024-43468)
CVE-2025-7636 SQL Injection in ZEUS PDKS (CVE-2025-7636)
CVE-2025-6830 SQL Injection in Xpoda Studio (CVE-2025-6830)
CVE-2026-1312 SQL Injection in django (CVE-2026-1312)
CVE-2026-1287 SQL Injection in django (CVE-2026-1287)
CVE-2026-1207 SQL Injection in django (CVE-2026-1207)
CVE-2025-5329 SQL Injection in Delta Course Automation (CVE-2025-5329)
CVE-2025-5319 SQL Injection in Efficiency Management System (CVE-2025-5319)
CVE-2025-8587 SQL Injection in SKSPro (CVE-2025-8587)
CVE-2025-4686 SQL Injection in Online Exam and Assessment (CVE-2025-4686)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details