# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [awwaiid mcp-server-taskwarrior vulnerable to command injection](https://agentprime.io/advisories/GHSA-95hg-3c55-xf9x.md) `GHSA-95hg-3c55-xf9x`, `CVE-2026-5833` · npm `mcp-server-taskwarrior`: affected `<=1.0.1`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, Command injection - [jeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injection](https://agentprime.io/advisories/CVE-2026-5848.md) `CVE-2026-5848` · CVE record: jeecgboot JimuReport · CVSS 5.1 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, Code injection - [PHPGurukul News Portal Project check_availability.php sql injection](https://agentprime.io/advisories/CVE-2026-5840.md) `CVE-2026-5840` · CVE record: PHPGurukul News Portal Project · CVSS 5.1 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, SQL injection - [PHPGurukul News Portal Project add-subcategory.php sql injection](https://agentprime.io/advisories/CVE-2026-5839.md) `CVE-2026-5839` · CVE record: PHPGurukul News Portal Project · CVSS 5.1 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, SQL injection - [PHPGurukul News Portal Project add-subadmins.php sql injection](https://agentprime.io/advisories/CVE-2026-5838.md) `CVE-2026-5838` · CVE record: PHPGurukul News Portal Project · CVSS 5.1 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, SQL injection - [PHPGurukul News Portal Project news-details.php sql injection](https://agentprime.io/advisories/CVE-2026-5837.md) `CVE-2026-5837` · CVE record: PHPGurukul News Portal Project · CVSS 6.9 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Simple IT Discussion Forum content.php sql injection](https://agentprime.io/advisories/CVE-2026-5829.md) `CVE-2026-5829` · CVE record: code-projects Simple IT Discussion Forum · CVSS 6.9 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Simple IT Discussion Forum addcomment.php sql injection](https://agentprime.io/advisories/CVE-2026-5828.md) `CVE-2026-5828` · CVE record: code-projects Simple IT Discussion Forum · CVSS 6.9 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Simple IT Discussion Forum question-function.php sql injection](https://agentprime.io/advisories/CVE-2026-5827.md) `CVE-2026-5827` · CVE record: code-projects Simple IT Discussion Forum · CVSS 6.9 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Simple Laundry System userchecklogin.php sql injection](https://agentprime.io/advisories/CVE-2026-5824.md) `CVE-2026-5824` · CVE record: code-projects Simple Laundry System · CVSS 6.9 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Other injection, SQL injection - [itsourcecode Construction Management System borrowed_tool_report.php sql injection](https://agentprime.io/advisories/CVE-2026-5823.md) `CVE-2026-5823` · CVE record: itsourcecode Construction Management System · CVSS 5.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Other injection, SQL injection - [PHPGurukul Online Course Registration check_availability.php sql injection](https://agentprime.io/advisories/CVE-2026-5814.md) `CVE-2026-5814` · CVE record: PHPGurukul Online Course Registration · CVSS 6.9 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Other injection, SQL injection - [PHPGurukul Online Course Registration check_availability.php sql injection](https://agentprime.io/advisories/CVE-2026-5813.md) `CVE-2026-5813` · CVE record: PHPGurukul Online Course Registration · CVSS 6.9 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Easy Blog Site contact_us.php sql injection](https://agentprime.io/advisories/CVE-2026-5805.md) `CVE-2026-5805` · CVE record: code-projects Easy Blog Site · CVSS 6.9 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Other injection, SQL injection - [basic-ftp has FTP Command Injection via CRLF](https://agentprime.io/advisories/GHSA-chqc-8p9q-pq6q.md) `GHSA-chqc-8p9q-pq6q`, `CVE-2026-39983` · npm `basic-ftp`: affected `>=5.2.0, <5.2.1`, fixed in `5.2.1` · CVSS 8.6 High · Not analysed yet · Published 8 Apr 2026 · Tags: Other injection - [CI4MS Vulnerable to .env CRLF Injection via Unvalidated \`host\` Parameter in Install Controller](https://agentprime.io/advisories/GHSA-vfhx-5459-qhqh.md) `GHSA-vfhx-5459-qhqh`, `CVE-2026-39394`, `PKSA-rh74-dqx1-j9wm` · Packagist `ci4-cms-erp/ci4ms`: affected `<0.31.4.0`, fixed in `0.31.4.0` · CVSS 8.1 High · Not analysed yet · Published 8 Apr 2026 · Tags: Other injection - [Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)](https://agentprime.io/advisories/GHSA-vvjj-xcjg-gr5g.md) `GHSA-vvjj-xcjg-gr5g`, `CVE-2026-82853` · npm `nodemailer`: affected `<8.0.5`, fixed in `8.0.5` · CVSS 6.9 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Other injection - [Hono missing validation of cookie name on write path in setCookie()](https://agentprime.io/advisories/GHSA-26pp-8wgv-hjvm.md) `GHSA-26pp-8wgv-hjvm`, `CVE-2026-56762` · npm `hono`: affected `<4.12.12`, fixed in `4.12.12` · CVSS 6.9 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Other injection, CWE-20 - [PowerJob's GroovyEvaluator.evaluate endpoint vulnerable to code injection](https://agentprime.io/advisories/GHSA-wpwf-v25w-54g3.md) `GHSA-wpwf-v25w-54g3`, `CVE-2026-5739` · Maven `tech.powerjob:powerjob-server-starter`: affected `>=5.1.0, <=5.1.2`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: Other injection, Code injection - [PowerJob vulnerable to SQL injection](https://agentprime.io/advisories/GHSA-4fp2-3xgg-jg4w.md) `GHSA-4fp2-3xgg-jg4w`, `CVE-2026-5736` · Maven `tech.powerjob:powerjob-server-starter`: affected `>=5.1.0, <=5.1.2`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: Other injection, SQL injection - [Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection](https://agentprime.io/advisories/CVE-2026-35521.md) `CVE-2026-35521` · CVE record: pi-hole FTL · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: Command injection, Other injection - [Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection](https://agentprime.io/advisories/CVE-2026-35520.md) `CVE-2026-35520` · CVE record: pi-hole FTL · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: Command injection, Other injection - [Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection](https://agentprime.io/advisories/CVE-2026-35519.md) `CVE-2026-35519` · CVE record: pi-hole FTL · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: Command injection, Other injection - [Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection](https://agentprime.io/advisories/CVE-2026-35518.md) `CVE-2026-35518` · CVE record: pi-hole FTL · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: Command injection, Other injection - [Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection](https://agentprime.io/advisories/CVE-2026-35517.md) `CVE-2026-35517` · CVE record: pi-hole FTL · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: Command injection, Other injection - [itsourcecode Construction Management System borrowedtool.php sql injection](https://agentprime.io/advisories/CVE-2026-5719.md) `CVE-2026-5719` · CVE record: itsourcecode Construction Management System · CVSS 5.3 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: Other injection, SQL injection - [itsourcecode sanitize or validate this input Parameter borrowedequip.php sql injection](https://agentprime.io/advisories/CVE-2026-5681.md) `CVE-2026-5681` · CVE record: itsourcecode sanitize or validate this input · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection - [itsourcecode Construction Management System Parameter borrowed_tool.php sql injection](https://agentprime.io/advisories/CVE-2026-5675.md) `CVE-2026-5675` · CVE record: itsourcecode Construction Management System · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection - [@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')](https://agentprime.io/advisories/GHSA-36xv-jgw5-4q75.md) `GHSA-36xv-jgw5-4q75`, `CVE-2026-35515` · npm `@nestjs/core`: affected `<11.1.18`, fixed in `11.1.18` · CVSS 6.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection - [Authorizer: CQL/N1QL Injection in Cassandra and Couchbase Backends via fmt.Sprintf String Interpolation](https://agentprime.io/advisories/GHSA-jfwg-rxf3-p7r9.md) `GHSA-jfwg-rxf3-p7r9`, `GO-2026-5467` · Go `github.com/authorizerdev/authorizer`: affected `<0.0.0-20260327055742-73679faa53cd`, fixed in `0.0.0-20260327055742-73679faa53cd` · CVSS 7.3 High · Not analysed yet · Published 6 Apr 2026 · Tags: Information disclosure, Other injection - [code-projects Simple IT Discussion Forum Parameter edit-category.php sql injection](https://agentprime.io/advisories/CVE-2026-5672.md) `CVE-2026-5672` · CVE record: code-projects Simple IT Discussion Forum · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection - [Cyber-III Student-Management-System Parameter login.php sql injection](https://agentprime.io/advisories/CVE-2026-5669.md) `CVE-2026-5669` · CVE record: Cyber-III Student-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection - [Plunk has a CRLF Email Header Injection in raw MIME message construction allows authenticated API user to inject arbitrary email headers](https://agentprime.io/advisories/CVE-2026-34975.md) `CVE-2026-34975` · CVE record: useplunk plunk · CVSS 8.5 High · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection - [code-projects Online FIR System Login checklogin.php sql injection](https://agentprime.io/advisories/CVE-2026-5665.md) `CVE-2026-5665` · CVE record: code-projects Online FIR System · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection - [itsourcecode Construction Management System Parameter borrowed_equip.php sql injection](https://agentprime.io/advisories/CVE-2026-5660.md) `CVE-2026-5660` · CVE record: itsourcecode Construction Management System · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Online Application System for Admission Endpoint admsnform.php sql injection](https://agentprime.io/advisories/CVE-2026-5649.md) `CVE-2026-5649` · CVE record: code-projects Online Application System for Admission · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Simple Laundry System Parameter userfinishregister.php sql injection](https://agentprime.io/advisories/CVE-2026-5648.md) `CVE-2026-5648` · CVE record: code-projects Simple Laundry System · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Easy Blog Site login.php sql injection](https://agentprime.io/advisories/CVE-2026-5646.md) `CVE-2026-5646` · CVE record: code-projects Easy Blog Site · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection - [projectworlds Car Rental System Parameter pay.php sql injection](https://agentprime.io/advisories/CVE-2026-5645.md) `CVE-2026-5645` · CVE record: projectworlds Car Rental System · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection - [PHPGurukul Online Shopping Portal Project Parameter update-image1.php sql injection](https://agentprime.io/advisories/CVE-2026-5641.md) `CVE-2026-5641` · CVE record: PHPGurukul Online Shopping Portal Project · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection - [PHPGurukul Online Shopping Portal Project Parameter update-image2.php sql injection](https://agentprime.io/advisories/CVE-2026-5640.md) `CVE-2026-5640` · CVE record: PHPGurukul Online Shopping Portal Project · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection - [PHPGurukul Online Shopping Portal Project Parameter update-image3.php sql injection](https://agentprime.io/advisories/CVE-2026-5639.md) `CVE-2026-5639` · CVE record: PHPGurukul Online Shopping Portal Project · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection - [projectworlds Car Rental System Parameter message_admin.php sql injection](https://agentprime.io/advisories/CVE-2026-5637.md) `CVE-2026-5637` · CVE record: projectworlds Car Rental System · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection - [PHPGurukul Online Shopping Portal Project Parameter cancelorder.php sql injection](https://agentprime.io/advisories/CVE-2026-5636.md) `CVE-2026-5636` · CVE record: PHPGurukul Online Shopping Portal Project · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection - [PHPGurukul Online Shopping Portal Project Parameter categorywise-products.php sql injection](https://agentprime.io/advisories/CVE-2026-5635.md) `CVE-2026-5635` · CVE record: PHPGurukul Online Shopping Portal Project · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection - [projectworlds Car Rental Project Parameter book_car.php sql injection](https://agentprime.io/advisories/CVE-2026-5634.md) `CVE-2026-5634` · CVE record: projectworlds Car Rental Project · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection - [assafelovic gpt-researcher ws Endpoint server_utils.py extract_command_data code injection](https://agentprime.io/advisories/CVE-2026-5631.md) `CVE-2026-5631` · CVE record: assafelovic gpt-researcher · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, Code injection - [itsourcecode Construction Management System Parameter borrowed_equip_report.php sql injection](https://agentprime.io/advisories/CVE-2026-5620.md) `CVE-2026-5620` · CVE record: itsourcecode Construction Management System · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection - [PHPGurukul Online Shopping Portal Project Parameter order-details.php sql injection](https://agentprime.io/advisories/CVE-2026-5606.md) `CVE-2026-5606` · CVE record: PHPGurukul Online Shopping Portal Project · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection - [griptape-ai griptape SqlTool tool.py sql injection](https://agentprime.io/advisories/CVE-2026-5596.md) `CVE-2026-5596` · CVE record: griptape-ai griptape · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [premAI-io premsql followup.py eval code injection](https://agentprime.io/advisories/CVE-2026-5594.md) `CVE-2026-5594` · CVE record: premAI-io premsql · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, Code injection - [wbbeyourself MAC-SQL Refiner Agent agents.py \_execute_sql sql injection](https://agentprime.io/advisories/CVE-2026-5587.md) `CVE-2026-5587` · CVE record: wbbeyourself MAC-SQL · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [zhongyu09 openchatbi Multi-stage Text2SQL Workflow sql injection](https://agentprime.io/advisories/CVE-2026-5586.md) `CVE-2026-5586` · CVE record: zhongyu09 openchatbi · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [Fosowl agenticSeek query Endpoint PyInterpreter.py PyInterpreter.execute code injection](https://agentprime.io/advisories/CVE-2026-5584.md) `CVE-2026-5584` · CVE record: Fosowl agenticSeek · CVSS 6.9 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, Code injection - [PHPGurukul Online Shopping Portal Project Parameter my-profile.php sql injection](https://agentprime.io/advisories/CVE-2026-5583.md) `CVE-2026-5583` · CVE record: PHPGurukul Online Shopping Portal Project · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [CodeAstro Online Classroom Parameter addvideos.php sql injection](https://agentprime.io/advisories/CVE-2026-5580.md) `CVE-2026-5580` · CVE record: CodeAstro Online Classroom · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [CodeAstro Online Classroom Parameter updatedetailsfromfaculty.php sql injection](https://agentprime.io/advisories/CVE-2026-5579.md) `CVE-2026-5579` · CVE record: CodeAstro Online Classroom · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [CodeAstro Online Classroom Parameter addassessment.php sql injection](https://agentprime.io/advisories/CVE-2026-5578.md) `CVE-2026-5578` · CVE record: CodeAstro Online Classroom · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [Song-Li cross_browser details Endpoint uniquemachine_app.py sql injection](https://agentprime.io/advisories/CVE-2026-5577.md) `CVE-2026-5577` · CVE record: Song-Li cross_browser · CVSS 6.9 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [SourceCodester/jkev Record Management System Login index.php sql injection](https://agentprime.io/advisories/CVE-2026-5575.md) `CVE-2026-5575` · CVE record: SourceCodester Record Management System and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .