Sign in Sign up
JA · EN · FR
SecPulse

Cwe 89

🧬 CWE Related 4,154
slug: cwe-89

Explanation

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。 攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。 対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。
📌 Example
Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 4,179

Image ID Title
CVE-2025-34243 SQL Injection in Advantech WebAccess/VPN (CVE-2025-34243)
CVE-2025-34244 SQL Injection in Advantech WebAccess/VPN (CVE-2025-34244)
CVE-2025-34245 SQL Injection in Advantech WebAccess/VPN (CVE-2025-34245)
CVE-2025-34246 SQL Injection in Advantech WebAccess/VPN (CVE-2025-34246)
CVE-2025-34240 SQL Injection in Advantech WebAccess/VPN (CVE-2025-34240)
CVE-2022-50589 SQL Injection in SuiteCRM (CVE-2022-50589)
CVE-2025-60239 SQL Injection in CoSchool LMS (CVE-2025-60239)
CVE-2025-28953 SQL Injection in smart SEO (CVE-2025-28953)
CVE-2025-10683 SQL Injection in Easy Email Subscription (WordPress plugin) (CVE-2025-10683)
CVE-2025-64114 SQL Injection in Oxygenz (CVE-2025-64114)
CVE-2025-6520 SQL Injection in BAPSIS (CVE-2025-6520)
CVE-2025-52664 SQL Injection in Revive Adserver (CVE-2025-52664)
CVE-2020-36869 Nagios XI versions prior to 5.7.5 contain a SQL injection vulnerability in the SNMP Trap Interface edit page. Exploitation requires an account with administrative privileges to access the affected int...
CVE-2020-36857 Nagios XI versions prior to 5.6.14 contain a post-authentication SQL injection vulnerability in the SNMP Trap Interface page. Exploitation requires an account with administrative privileges to access...
CVE-2016-15050 Nagios XI versions prior to 5.2.4 contain a SQL injection vulnerability in the notification search functionality. User-supplied search parameters were incorporated into SQL statements without adequate...
CVE-2012-10063 Nagios XI versions prior to 2012R1.3 contain a SQL injection vulnerability in the legacy Core Configuration Manager (CCM) interface. Authenticated users could manipulate SQL queries by supplying craft...
CVE-2025-4665 SQL Injection in WordPress plugin Contact Form CFDB7 (CVE-2025-4665)
CVE-2025-62367 SQL Injection in Taiga (CVE-2025-62367)
CVE-2025-11735 SQL Injection in HUSKY – Products Filter Professional for WooCommerce (WordPress plugin) (CVE-2025-11735)
CVE-2025-12336 Vulnerability in Campcodes Retro Basketball Shoes Online Store (CVE-2025-12336)
CVE-2025-12337 Vulnerability in Campcodes Retro Basketball Shoes Online Store (CVE-2025-12337)
CVE-2025-12338 Vulnerability in Campcodes Retro Basketball Shoes Online Store (CVE-2025-12338)
CVE-2025-12339 Vulnerability in Campcodes Retro Basketball Shoes Online Store (CVE-2025-12339)
CVE-2025-12342 Vulnerability in Serdar Bayram Ghost Hot Spot (CVE-2025-12342)
CVE-2025-12329 Vulnerability in shawon100 RUET OJ (CVE-2025-12329)
CVE-2025-12328 Vulnerability in shawon100 RUET OJ (CVE-2025-12328)
CVE-2025-12325 Vulnerability in SourceCodester Best Salon Management System (CVE-2025-12325)
CVE-2025-12326 Vulnerability in shawon100 RUET OJ (CVE-2025-12326)
CVE-2025-12327 Vulnerability in shawon100 RUET OJ (CVE-2025-12327)
CVE-2025-12316 Vulnerability in code-projects Courier Management System (CVE-2025-12316)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details