# Other injection.

LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first

- [Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)](https://agentprime.io/advisories/CVE-2026-85076.md)
  `CVE-2026-85076` · CVE record: jhuckaby Cronicle · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Other injection, Broken access control
- [SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User](https://agentprime.io/advisories/CVE-2026-100365.md)
  `CVE-2026-100365` · CVE record: SuiteCRM SuiteCRM · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection, Other injection
- [SuiteCRM: Authenticated SQL Injection in v4_1 get_entry_list rest api](https://agentprime.io/advisories/CVE-2026-63214.md)
  `CVE-2026-63214` · CVE record: SuiteCRM SuiteCRM · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection, Other injection
- [mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines](https://agentprime.io/advisories/CVE-2026-123095.md)
  `CVE-2026-123095` · CVE record: mpv-player mpv · CVSS 7.7 High · Not analysed yet · Published 5 Nov 2026 · Tags: Other injection
- [itsourcecode Online Book Store admin_edit.php sql injection](https://agentprime.io/advisories/CVE-2026-123028.md)
  `CVE-2026-123028` · CVE record: itsourcecode Online Book Store · CVSS 6.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Other injection, SQL injection
- [Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization](https://agentprime.io/advisories/CVE-2026-103864.md)
  `CVE-2026-103864` · CVE record: Apache Software Foundation Apache Sling Engine · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Other injection
- [Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data](https://agentprime.io/advisories/CVE-2026-73117.md)
  `CVE-2026-73117` · CVE record: Apache Software Foundation Apache Juneau · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Other injection
- [eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injection](https://agentprime.io/advisories/CVE-2026-123018.md)
  `CVE-2026-123018` · CVE record: eosphoros-ai DB-GPT · CVSS 6.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Other injection, Code injection
- [itsourcecode Airline Reservation System manage_booked.php sql injection](https://agentprime.io/advisories/CVE-2026-122191.md)
  `CVE-2026-122191` · CVE record: itsourcecode Airline Reservation System · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Other injection, SQL injection
- [Edimax BR-6208AC mp command injection](https://agentprime.io/advisories/CVE-2026-122051.md)
  `CVE-2026-122051` · CVE record: Edimax BR-6208AC · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Other injection, Command injection
- [Campcodes Complete Sales and Inventory System with Credit Management login.php sql injection](https://agentprime.io/advisories/CVE-2026-122050.md)
  `CVE-2026-122050` · CVE record: Campcodes Complete Sales and Inventory System with Credit Management · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Other injection, SQL injection
- [Campcodes Division Regional Athletic Meet Game Result Matrix System check-user.php sql injection](https://agentprime.io/advisories/CVE-2026-122048.md)
  `CVE-2026-122048` · CVE record: Campcodes Division Regional Athletic Meet Game Result Matrix System · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Other injection, SQL injection
- [krupalshah EmployeeRecruitmentSystem Requirement Board Update reqformprocessing.php mysql_query sql injection](https://agentprime.io/advisories/CVE-2026-122038.md)
  `CVE-2026-122038` · CVE record: krupalshah EmployeeRecruitmentSystem · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Other injection, SQL injection
- [NPC-Worldwide npcpy sft.py load_sft_model code injection](https://agentprime.io/advisories/CVE-2026-122014.md)
  `CVE-2026-122014` · CVE record: NPC-Worldwide npcpy · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Other injection, Code injection
- [Multiple vulnerabilities that affects IBM Db2 Genius Hub](https://agentprime.io/advisories/CVE-2026-108767.md)
  `CVE-2026-108767` · CVE record: IBM Db2 Genius Hub · CVSS 4.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Other injection
- [IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability](https://agentprime.io/advisories/CVE-2026-12356.md)
  `CVE-2026-12356` · CVE record: IBM MQ · CVSS 7.5 High · Not analysed yet · Published 4 Nov 2026 · Tags: Other injection
- [zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders](https://agentprime.io/advisories/CVE-2026-121946.md)
  `CVE-2026-121946` · CVE record: zbateson mail-mime-parser · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Other injection
- [Multiple vulnerabilities in Coupa’s Total Spend Management Platform](https://agentprime.io/advisories/CVE-2026-111038.md)
  `CVE-2026-111038` · CVE record: Coupa Coupa Total Spend Management Platform · CVSS 7.3 High · Not analysed yet · Published 4 Nov 2026 · Tags: Other injection
- [LDAP wildcard injection exposes GINA recipient accounts](https://agentprime.io/advisories/CVE-2026-114420.md)
  `CVE-2026-114420` · CVE record: SEPPmail AG SEPPmail Secure Email Gateway (SEG) · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Other injection
- [funadmin Frontend List Endpoint index selectList sql injection](https://agentprime.io/advisories/CVE-2026-121610.md)
  `CVE-2026-121610` · CVE record: funadmin · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Other injection, SQL injection
- [CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push](https://agentprime.io/advisories/CVE-2026-120639.md)
  `CVE-2026-120639` · CVE record · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Other injection
- [Tanium addressed an improper output sanitization vulnerability in Discover.](https://agentprime.io/advisories/CVE-2026-116648.md)
  `CVE-2026-116648` · CVE record: Tanium Discover · CVSS 4.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Other injection
- [sumiie24 School-Management-System Public Search Feature parent_Login.php sql injection](https://agentprime.io/advisories/CVE-2026-121524.md)
  `CVE-2026-121524` · CVE record: sumiie24 School-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Other injection, SQL injection
- [Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()](https://agentprime.io/advisories/CVE-2026-115779.md)
  `CVE-2026-115779` · CVE record: Effect-TS effect and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Other injection
- [mathurvishal CloudClassroom-PHP-Project facultydetails.php sql injection](https://agentprime.io/advisories/CVE-2026-121502.md)
  `CVE-2026-121502` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Other injection, SQL injection
- [EF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field reference](https://agentprime.io/advisories/CVE-2026-120567.md)
  `CVE-2026-120567` · CVE record: MongoDB Entity Framework Core Provider · CVSS 2.3 Low · Not analysed yet · Published 3 Nov 2026 · Tags: Other injection
- [Yeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parameters](https://agentprime.io/advisories/CVE-2026-63489.md)
  `CVE-2026-63489` · CVE record: yeti-platform yeti · CVSS 7.6 High · Not analysed yet · Published 3 Nov 2026 · Tags: Other injection
- [OPNsense: Configuration line injection via multiple GUI text fields](https://agentprime.io/advisories/CVE-2026-57154.md)
  `CVE-2026-57154` · CVE record: opnsense core · CVSS 8.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Other injection
- [Potential log injection via unescaped geometry form values](https://agentprime.io/advisories/CVE-2026-111211.md)
  `CVE-2026-111211` · CVE record: djangoproject Django · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Other injection
- [Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injection](https://agentprime.io/advisories/CVE-2026-121260.md)
  `CVE-2026-121260` · CVE record: Ziroom ZHOME A0101 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Other injection, Code injection
- [AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export](https://agentprime.io/advisories/CVE-2026-121433.md)
  `CVE-2026-121433` · CVE record: AzuraCast AzuraCast · CVSS 5.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Other injection
- [AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist](https://agentprime.io/advisories/CVE-2026-121432.md)
  `CVE-2026-121432` · CVE record: AzuraCast AzuraCast · CVSS 5.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Other injection
- [Apache HertzBeat: incomplete XPath expression validation in aliasFields](https://agentprime.io/advisories/CVE-2026-114442.md)
  `CVE-2026-114442` · CVE record: Apache Software Foundation Apache HertzBeat · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Other injection
- [TYPO3-EXT-SA-2026-037: Broken Access Control in extension "Mail" (mail)](https://agentprime.io/advisories/PKSA-p6j1-yhwr-yntb.md)
  `PKSA-p6j1-yhwr-yntb`, `CVE-2026-120329` · Packagist `mediaessenz/mail`: affected `<3.12.5 || >=4.0.0, <4.2.0`, fixed in `3.12.5`, `4.2.0` · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Other injection
- [dayrui XunRuiCMS Mobile Site Directory index.php str_replace code injection](https://agentprime.io/advisories/CVE-2026-120349.md)
  `CVE-2026-120349` · CVE record: dayrui XunRuiCMS · CVSS 6.9 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Other injection, Code injection
- [dayrui XunRuiCMS Email Template Rendering Notice.php \_get_tpl_content code injection](https://agentprime.io/advisories/CVE-2026-120348.md)
  `CVE-2026-120348` · CVE record: dayrui XunRuiCMS · CVSS 6.9 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Other injection, Code injection
- [dayrui XunRuiCMS Member View.php View sql injection](https://agentprime.io/advisories/CVE-2026-120347.md)
  `CVE-2026-120347` · CVE record: dayrui XunRuiCMS · CVSS 6.9 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Other injection, SQL injection
- [mathurvishal CloudClassroom-PHP-Project viewquery.php sql injection](https://agentprime.io/advisories/CVE-2026-120342.md)
  `CVE-2026-120342` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Other injection, SQL injection
- [beecue FastBee Groovy Script Executor script code injection](https://agentprime.io/advisories/CVE-2026-120274.md)
  `CVE-2026-120274` · CVE record: beecue FastBee · CVSS 5.1 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Other injection, Code injection
- [HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI](https://agentprime.io/advisories/CVE-2026-13575.md)
  `CVE-2026-13575` · CVE record · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Other injection
- [WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection](https://agentprime.io/advisories/CVE-2026-120198.md)
  `CVE-2026-120198` · CVE record: WAVLINK WL-WN530BE1-A · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Other injection, Command injection
- [Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header](https://agentprime.io/advisories/CVE-2026-120201.md)
  `CVE-2026-120201` · CVE record: dromara Jpom · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2026 · Tags: Other injection
- [AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE](https://agentprime.io/advisories/GHSA-p96f-p2p2-2g3h.md)
  `GHSA-p96f-p2p2-2g3h`, `CVE-2026-96634`, `PKSA-3qwh-zmfw-wy96` · Packagist `adminneo-org/adminneo`: affected `<5.5.1`, fixed in `5.5.1` · CVSS 4.0, no score published · Not analysed yet · Published 30 Oct 2026 · Tags: Other injection
- [AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers](https://agentprime.io/advisories/GHSA-79wv-8rh2-9vp2.md)
  `GHSA-79wv-8rh2-9vp2`, `CVE-2026-96631`, `PKSA-31n1-gk84-zwsg` · Packagist `adminneo-org/adminneo`: affected `>=4.6.0, <5.5.1`, fixed in `5.5.1` · CVSS 8.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Other injection, CWE-20
- [37954679 cak-filemanagement-system save_student.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-119619.md)
  `CVE-2026-119619` · CVE record: 37954679 cak-filemanagement-system · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Other injection, SQL injection
- [Injection in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-91915.md)
  `CVE-2026-91915` · CVE record: Dell OpenManage Enterprise · CVSS 6.8 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Other injection
- [CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name](https://agentprime.io/advisories/CVE-2026-118994.md)
  `CVE-2026-118994` · CVE record · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Other injection
- [OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields](https://agentprime.io/advisories/CVE-2026-119560.md)
  `CVE-2026-119560` · CVE record: opnsense core · CVSS 6.0 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Other injection
- [OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity](https://agentprime.io/advisories/CVE-2026-119424.md)
  `CVE-2026-119424` · CVE record: opnsense core · CVSS 6.1 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Other injection
- [OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username](https://agentprime.io/advisories/CVE-2026-119423.md)
  `CVE-2026-119423` · CVE record: opnsense core · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Other injection
- [CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type](https://agentprime.io/advisories/CVE-2026-119415.md)
  `CVE-2026-119415` · CVE record: cakephp cakephp · CVSS 6.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Other injection
- [Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter](https://agentprime.io/advisories/CVE-2026-89435.md)
  `CVE-2026-89435` · CVE record: strategy11team Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Other injection
- [Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping](https://agentprime.io/advisories/CVE-2026-115303.md)
  `CVE-2026-115303` · CVE record: Unknown Contact Form by Supsystic · CVSS 3.7 Low · Not analysed yet · Published 29 Oct 2026 · Tags: Other injection
- [OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)](https://agentprime.io/advisories/CVE-2026-54453.md)
  `CVE-2026-54453` · CVE record: opencats OpenCATS · CVSS 7.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Other injection, Code injection
- [Waline login accepts a non-string email as a match-all MongoDB query](https://agentprime.io/advisories/GHSA-jf75-q64q-g65r.md)
  `GHSA-jf75-q64q-g65r`, `CVE-2026-55369` · npm `@waline/vercel`: affected `<1.41.0`, fixed in `1.41.0` · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass, Other injection
- [i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string](https://agentprime.io/advisories/GHSA-3cmx-xjww-583x.md)
  `GHSA-3cmx-xjww-583x`, `CVE-2026-118258` · npm `i18next-http-backend`: affected `<4.0.4`, fixed in `4.0.4` · CVSS 3.7 Low · Not analysed yet · Published 28 Oct 2026 · Tags: Other injection
- [i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)](https://agentprime.io/advisories/GHSA-9jhj-wvmw-cfx5.md)
  `GHSA-9jhj-wvmw-cfx5`, `CVE-2026-115730` · npm `i18next-http-backend`: affected `<4.0.3`, fixed in `4.0.3` · CVSS 2.3 Low · Not analysed yet · Published 28 Oct 2026 · Tags: Other injection
- [n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter](https://agentprime.io/advisories/CVE-2026-118645.md)
  `CVE-2026-118645` · CVE record: n8n-io n8n · CVSS 7.0 High · Not analysed yet · Published 28 Oct 2026 · Tags: Other injection
- [n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes](https://agentprime.io/advisories/CVE-2026-118641.md)
  `CVE-2026-118641` · CVE record: n8n-io n8n · CVSS 6.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Other injection
- [NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol](https://agentprime.io/advisories/CVE-2026-118581.md)
  `CVE-2026-118581` · CVE record: MongoDB Java Driver · CVSS 6.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Other injection

Older: <https://agentprime.io/advisories/tag/injection.md?cursor=WyIyMDI2LTEwLTI4VDE2OjUxOjIxLjk2MDAwMFoiLCJDVkUtMjAyNi0xMTg1ODEiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=injection>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/injection/>. Everything for agents: <https://agentprime.io/llms.txt>.