Cwe 89

🧬 CWE Liées 4,188

slug: cwe-89

Explication

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。

📌 Exemple

Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。

🔗 Liens utiles

🔖 Étiquettes liées

Cwe 798783 Cwe 8624077 Cwe 2844037 Cwe 4163898 Cwe 1193186 Cwe 2003160 Cwe 1253129 Cwe 202861 Cwe 222781 Cwe 7872527 Cwe 782043 Cwe 941886 Cwe 8631885 Cwe 741810 Cwe 1221802

🛡 Vulnérabilités associées 4,343

ID	Titre	Gravité	Détecté
CVE-2026-40836	An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	il y a 4 mois
CVE-2026-40832	An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	Medium	il y a 4 mois
CVE-2026-40837	An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	Medium	il y a 4 mois
CVE-2026-40816	An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	il y a 4 mois
CVE-2026-40814	An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	il y a 4 mois
CVE-2026-40817	An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	il y a 4 mois
CVE-2026-40821	A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	Medium	il y a 4 mois
CVE-2026-40826	A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	Medium	il y a 4 mois
CVE-2026-40818	An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	il y a 4 mois
CVE-2026-40815	An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	il y a 4 mois
CVE-2026-40824	A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	Medium	il y a 4 mois
CVE-2026-7618	Injection SQL dans EnvíaloSimple: Email Marketing y Newsletters (WordPress plugin) (CVE-2026-7618)	Medium	il y a 4 mois
CVE-2026-40822	A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	Medium	il y a 4 mois
CVE-2026-40819	An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	il y a 4 mois
CVE-2026-40823	A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	Medium	il y a 4 mois
CVE-2026-40825	A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	Medium	il y a 4 mois
CVE-2026-40812	An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	il y a 4 mois
CVE-2026-40811	An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	il y a 4 mois
CVE-2026-40810	An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	il y a 4 mois
CVE-2026-40813	An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in...	High	il y a 4 mois
CVE-2026-44741	Injection SQL dans pimcore/admin-ui-classic-bundle (CVE-2026-44741)	High	il y a 4 mois
CVE-2026-44739	Injection SQL dans pimcore/pimcore (CVE-2026-44739)	High	il y a 4 mois
CVE-2026-9607	Vulnérabilité dans itsourcecode Courier Management System (CVE-2026-9607)	Medium	il y a 4 mois
CVE-2026-9606	Vulnérabilité dans itsourcecode Courier Management System (CVE-2026-9606)	High	il y a 4 mois
CVE-2026-9584	Vulnérabilité dans code-projects Project Management System (CVE-2026-9584)	High	il y a 4 mois
CVE-2026-9573	Vulnérabilité dans itsourcecode Student Transcript Processing System (CVE-2026-9573)	High	il y a 4 mois
CVE-2026-9574	Vulnérabilité dans itsourcecode Student Transcript Processing System (CVE-2026-9574)	High	il y a 4 mois
CVE-2026-9575	Vulnérabilité dans itsourcecode Student Transcript Processing System (CVE-2026-9575)	High	il y a 4 mois
CVE-2026-46624	Injection de commande OS dans Twenty (CVE-2026-46624)	Critical	il y a 4 mois
CVE-2026-44706	Injection SQL dans Chatwoot (CVE-2026-44706)	High	il y a 4 mois