Sign in Sign up
JA · EN · FR
SecPulse

Cwe 89

🧬 CWE Related 4,154
slug: cwe-89

Explanation

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。 攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。 対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。
📌 Example
Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 4,162

Image ID Title
CVE-2026-97882 Vulnerability in mathurvishal CloudClassroom-PHP-Project (CVE-2026-97882)
CVE-2026-97885 Vulnerability in mathurvishal CloudClassroom-PHP-Project (CVE-2026-97885)
CVE-2026-54790 SQL Injection in InvoicePlane (CVE-2026-54790)
CVE-2026-62262 Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is…
CVE-2026-42324 SQL Injection in Piwigo (CVE-2026-42324)
CVE-2026-42323 SQL Injection in Piwigo (CVE-2026-42323)
CVE-2026-44642 SQL Injection in Piwigo (CVE-2026-44642)
CVE-2026-33639 SQL Injection in InvoicePlane (CVE-2026-33639)
CVE-2026-84893 SQL Injection in IBM Guardium Data Protection (CVE-2026-84893)
CVE-2026-93899 SQL Injection in WordPress (CVE-2026-93899)
CVE-2026-97321 Vulnerability in YunaiV/zhijiantianya ruoyi-vue-pro (CVE-2026-97321)
CVE-2026-13016 ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI...
CVE-2026-56738 SQL Injection in phpmyfaq/phpmyfaq (CVE-2026-56738)
CVE-2026-77874 SQL Injection in IBM Enterprise Build of Quarkus (CVE-2026-77874)
CVE-2026-78311 SQL Injection in DIAEnergie (CVE-2026-78311)
CVE-2026-78309 SQL Injection in DIAEnergie (CVE-2026-78309)
CVE-2026-96777 Vulnerability in Forma LMS (CVE-2026-96777)
CVE-2026-96803 Vulnerability in java110 MicroCommunity (CVE-2026-96803)
CVE-2026-96751 Vulnerability in pmTicket Project-Management-Software (CVE-2026-96751)
CVE-2026-96604 Vulnerability in SoftNews Media Group DataLife Engine (CVE-2026-96604)
CVE-2026-96601 Vulnerability in Abdurrab5 online-makeup-store (CVE-2026-96601)
CVE-2026-96602 Vulnerability in Abdurrab5 online-makeup-store (CVE-2026-96602)
CVE-2026-96826 SQL Injection in W4 Post List (CVE-2026-96826)
CVE-2026-95601 Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.
CVE-2026-95593 SQL Injection in Ultimeter (CVE-2026-95593)
CVE-2026-95590 SQL Injection in Tainacan (CVE-2026-95590)
CVE-2026-95522 SQL Injection in Easy Digital Downloads (CVE-2026-95522)
CVE-2026-94174 SQL Injection in Email Log (CVE-2026-94174)
CVE-2026-94124 SQL Injection in WP EasyCart (CVE-2026-94124)
CVE-2026-93773 SQL Injection in Mollie Forms (CVE-2026-93773)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details