Sign in Sign up
JA · EN · FR
SecPulse

Cwe 89

🧬 CWE Related 54
slug: cwe-89

Explanation

CWE-89は「Webアプリがユーザー入力をきちんとパラメータ化せずにSQL文に埋め込んでしまう欠陥」のことです。 攻撃者はSQL文の構造を書き換えてデータベースを直接操作でき、全ユーザーのID/パスワードを抜く・データ改ざん・データベース全削除など何でもされます。 対策は「プリペアドステートメント (パラメータ化クエリ)」を必ず使うこと。
📌 Example
Equifax事件 (2017): 米国最大の信用情報機関で1.4億人の個人情報流出。直接的にはApache Strutsの脆弱性だったが、SQLi脆弱性を経由した類似事件は無数にある。
🔗 Related links

🔖 Related tags

Cwe 20125 Cwe 78120 Cwe 787105 Cwe 41699 Cwe 2296 Cwe 11990 Cwe 9484 Cwe 50270 Cwe 7966 Cwe 91844 Cwe 28443 Cwe 28741 Cwe 7740 Cwe 30638 Cwe 84337

🛡 Vulnerabilities tagged with this 2,552

ID Title
CVE-2026-15361 SQL Injection in wordpress (CVE-2026-15361)
CVE-2026-19196 Vulnerability in sqli (CVE-2026-19196)
CVE-2026-67689 SQL Injection in sqli (CVE-2026-67689)
CVE-2026-19067 Vulnerability in sqli (CVE-2026-19067)
CVE-2026-19070 Vulnerability in sqli (CVE-2026-19070)
CVE-2026-19068 Vulnerability in sqli (CVE-2026-19068)
CVE-2026-19071 Vulnerability in sqli (CVE-2026-19071)
CVE-2026-19069 Vulnerability in sqli (CVE-2026-19069)
CVE-2026-19062 Vulnerability in sqli (CVE-2026-19062)
CVE-2026-3430 SQL Injection in wordpress (CVE-2026-3430)
CVE-2026-66447 Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.
CVE-2026-65569 Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions.
CVE-2026-65546 Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.
CVE-2026-65547 Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.
CVE-2026-65520 Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.
CVE-2026-65508 Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.
CVE-2026-34191 SQL Injection in apache (CVE-2026-34191)
CVE-2026-5134 SQL Injection in sqli (CVE-2026-5134)
CVE-2026-19020 Vulnerability in sqli (CVE-2026-19020)
CVE-2026-19021 Vulnerability in sqli (CVE-2026-19021)
CVE-2026-16065 SQL Injection in wordpress (CVE-2026-16065)
CVE-2026-12713 SQL Injection in wordpress (CVE-2026-12713)
CVE-2026-18970 Vulnerability in sqli (CVE-2026-18970)
CVE-2026-18958 Vulnerability in sqli (CVE-2026-18958)
CVE-2026-10716 SQL Injection in sqli (CVE-2026-10716)
CVE-2026-71288 Koha's guided report builder (reports/guided_reports.pl) reads the `order_by` CGI parameter and,...
CVE-2026-71287 Cacti's sanitize_sql_column() (lib/functions.php) sanitizes user-supplied ORDER BY column names...
CVE-2026-71292 SQL Injection in CVE-2026-71292 (CVE-2026-71292)
CVE-2026-71276 SQL Injection in sqli (CVE-2026-71276)
CVE-2026-71282 SQL Injection in CVE-2026-71282 (CVE-2026-71282)

🍪 About cookies

We use cookies to keep you logged in, remember your language, and improve the service.

Details →