Connexion Inscription
JA · EN · FR
SecPulse

Cwe 89

🧬 CWE Liées 4,152
slug: cwe-89

Explication

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。 攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。 対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。
📌 Exemple
Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。
🔗 Liens utiles

🔖 Étiquettes liées

Cwe 798678 Cwe 8624031 Cwe 2844027 Cwe 4163896 Cwe 1193182 Cwe 2003138 Cwe 1253115 Cwe 202856 Cwe 222769 Cwe 7872517 Cwe 782021 Cwe 941870 Cwe 8631865 Cwe 1221799 Cwe 741796

🛡 Vulnérabilités associées 4,154

Image ID Titre
CVE-2026-103229 A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to…
CVE-2026-103230 A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to…
CVE-2026-76570 Injection SQL dans Joomcode (CVE-2026-76570)
CVE-2026-62097 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business…
CVE-2026-18782 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital…
CVE-2026-82307 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software…
CVE-2026-97293 Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.
CVE-2026-97287 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web /…
CVE-2026-96827 Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.
CVE-2026-96828 Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.
CVE-2026-96822 Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.
CVE-2026-96345 Administrator SQL Injection in Estatik <= 4.3.5 versions.
CVE-2026-96346 Author SQL Injection in WP ERP <= 1.17.9 versions.
CVE-2026-94177 Injection SQL dans GamiPress (CVE-2026-94177)
CVE-2026-94115 Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.
CVE-2026-94082 Author SQL Injection in Quiz Cat <= 3.1.1 versions.
CVE-2026-93621 Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.
CVE-2026-62085 Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.
CVE-2026-103117 A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties…
CVE-2026-103116 A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file…
CVE-2026-103115 A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file…
CVE-2026-103114 A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function…
CVE-2026-103113 A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of…
CVE-2026-102578 Injection SQL dans Moodle (CVE-2026-102578)
CVE-2026-102456 EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject…
CVE-2026-6806 Injection SQL dans WordPress (CVE-2026-6806)
CVE-2026-16596 Injection SQL dans WordPress (CVE-2026-16596)
CVE-2026-102913 A security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impacted is an unknown…
CVE-2026-102912 A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown…
CVE-2026-102910 A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an…

Nous utilisons des cookies pour l'analyse d'audience et la mesure publicitaire. Ce réglage s'applique à tous les sites de Game co., Ltd. En savoir plus