# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [QueryMine sms GET Request Parameter editcourse.php sql injection](https://agentprime.io/advisories/CVE-2026-6488.md) `CVE-2026-6488` · CVE record: QueryMine sms · CVSS 5.3 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Other injection, SQL injection - [Aap-mcp-server: aap mcp server: log injection allows social engineering attacks via unsanitized input](https://agentprime.io/advisories/CVE-2026-6494.md) `CVE-2026-6494` · CVE record: Red Hat Red Hat Ansible Automation Platform 2 · CVSS 5.3 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Other injection - [Quiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields](https://agentprime.io/advisories/CVE-2026-5797.md) `CVE-2026-5797` · CVE record: expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker · CVSS 5.3 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Other injection - [Flowise: Cypher Injection in GraphCypherQAChain](https://agentprime.io/advisories/GHSA-28g4-38q8-3cwc.md) `GHSA-28g4-38q8-3cwc`, `CVE-2026-41274` · npm `flowise` and 1 more: affected `<3.1.0`, fixed in `3.1.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2026 · Tags: Other injection - [Openfind｜MailGates/MailAudit - CRLF Injection](https://agentprime.io/advisories/CVE-2026-6351.md) `CVE-2026-6351` · CVE record: Openfind MailGates and 1 more · CVSS 8.7 High · Not analysed yet · Published 16 Apr 2026 · Tags: Other injection - [Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()](https://agentprime.io/advisories/GHSA-47hf-23pw-3m8c.md) `GHSA-47hf-23pw-3m8c`, `CVE-2026-41230`, `PKSA-zvbr-5xtx-pwd7` · Packagist `froxlor/froxlor`: affected `<2.3.6`, fixed in `2.3.6` · CVSS 8.5 High · Not analysed yet · Published 16 Apr 2026 · Tags: Other injection - [Serendipity has a Host Header Injection allows SMTP header injection via unvalidated HTTP_HOST in Message-ID email header](https://agentprime.io/advisories/GHSA-458g-q4fh-mj6r.md) `GHSA-458g-q4fh-mj6r`, `CVE-2026-39971`, `PKSA-fdbd-416g-v2zm` · Packagist `s9y/serendipity`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 7.2 High · Not analysed yet · Published 14 Apr 2026 · Tags: Other injection - [CRLF injection in Schneider Electric PowerChute™ Serial Shutdown](https://agentprime.io/advisories/CVE-2026-2400.md) `CVE-2026-2400` · CVE record: Schneider Electric PowerChute™ Serial Shutdown · CVSS 5.3 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Other injection - [mitmproxy has an LDAP Injection](https://agentprime.io/advisories/GHSA-527g-3w9m-29hv.md) `GHSA-527g-3w9m-29hv`, `CVE-2026-40606`, `PYSEC-2026-92` · PyPI `mitmproxy`: affected `<12.2.2`, fixed in `12.2.2` · CVSS 4.8 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Other injection - [MaxKB: Sandbox Result Validation Bypass via Tool Output Spoofing](https://agentprime.io/advisories/CVE-2026-39419.md) `CVE-2026-39419` · CVE record: 1Panel-dev MaxKB · CVSS 3.1 Low · Not analysed yet · Published 14 Apr 2026 · Tags: Other injection, Authentication bypass, CWE-693 - [MaxKB has CSV Injection in its Application Chat Export Functionality](https://agentprime.io/advisories/CVE-2026-39424.md) `CVE-2026-39424` · CVE record: 1Panel-dev MaxKB · CVSS 5.3 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Other injection - [An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code and escalate privileges via the CSV registration field](https://agentprime.io/advisories/CVE-2026-31049.md) `CVE-2026-31049` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Apr 2026 · Tags: Other injection - [aandrew-me ytDownloader Compressor Feature compressor.js child_process.exec command injection](https://agentprime.io/advisories/CVE-2026-6219.md) `CVE-2026-6219` · CVE record: aandrew-me ytDownloader · CVSS 4.8 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, Command injection - [Maddy Mail Server has an LDAP Filter Injection via Unsanitized Username](https://agentprime.io/advisories/GHSA-5835-4gvc-32pc.md) `GHSA-5835-4gvc-32pc`, `CVE-2026-40193`, `GO-2026-5137` · Go `github.com/foxcpp/maddy`: affected `<0.9.3`, fixed in `0.9.3` · CVSS 8.2 High · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection - [code-projects Easy Blog Site post.php sql injection](https://agentprime.io/advisories/CVE-2026-6202.md) `CVE-2026-6202` · CVE record: code-projects Easy Blog Site · CVSS 5.3 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection - [PHPGurukul Daily Expense Tracking System register.php sql injection](https://agentprime.io/advisories/CVE-2026-6193.md) `CVE-2026-6193` · CVE record: PHPGurukul Daily Expense Tracking System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection - [itsourcecode Construction Management System equipments.php sql injection](https://agentprime.io/advisories/CVE-2026-6191.md) `CVE-2026-6191` · CVE record: itsourcecode Construction Management System · CVSS 5.3 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection - [itsourcecode Construction Management System employees.php sql injection](https://agentprime.io/advisories/CVE-2026-6190.md) `CVE-2026-6190` · CVE record: itsourcecode Construction Management System · CVSS 5.3 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection - [SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection](https://agentprime.io/advisories/CVE-2026-6189.md) `CVE-2026-6189` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection - [SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection](https://agentprime.io/advisories/CVE-2026-6188.md) `CVE-2026-6188` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection - [SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection](https://agentprime.io/advisories/CVE-2026-6187.md) `CVE-2026-6187` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Simple Content Management System index.php sql injection](https://agentprime.io/advisories/CVE-2026-6183.md) `CVE-2026-6183` · CVE record: code-projects Simple Content Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Simple Content Management System login.php sql injection](https://agentprime.io/advisories/CVE-2026-6182.md) `CVE-2026-6182` · CVE record: code-projects Simple Content Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Faculty Management System subject-print.php sql injection](https://agentprime.io/advisories/CVE-2026-6167.md) `CVE-2026-6167` · CVE record: code-projects Faculty Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Vehicle Showroom Management System UpdateVehicleFunction.php sql injection](https://agentprime.io/advisories/CVE-2026-6166.md) `CVE-2026-6166` · CVE record: code-projects Vehicle Showroom Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Vehicle Showroom Management System Login_check.php sql injection](https://agentprime.io/advisories/CVE-2026-6165.md) `CVE-2026-6165` · CVE record: code-projects Vehicle Showroom Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Lost and Found Thing Management addcat.php sql injection](https://agentprime.io/advisories/CVE-2026-6164.md) `CVE-2026-6164` · CVE record: code-projects Lost and Found Thing Management · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Lost and Found Thing Management catageory.php sql injection](https://agentprime.io/advisories/CVE-2026-6163.md) `CVE-2026-6163` · CVE record: code-projects Lost and Found Thing Management · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Simple ChatBox Endpoint insert.php sql injection](https://agentprime.io/advisories/CVE-2026-6161.md) `CVE-2026-6161` · CVE record: code-projects Simple ChatBox · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Vehicle Showroom Management System StaffDetailsFunction.php sql injection](https://agentprime.io/advisories/CVE-2026-6153.md) `CVE-2026-6153` · CVE record: code-projects Vehicle Showroom Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Vehicle Showroom Management System StaffAddingFunction.php sql injection](https://agentprime.io/advisories/CVE-2026-6152.md) `CVE-2026-6152` · CVE record: code-projects Vehicle Showroom Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Vehicle Showroom Management System PaymentStatusFunction.php sql injection](https://agentprime.io/advisories/CVE-2026-6151.md) `CVE-2026-6151` · CVE record: code-projects Vehicle Showroom Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Vehicle Showroom Management System BookVehicleFunction.php sql injection](https://agentprime.io/advisories/CVE-2026-6149.md) `CVE-2026-6149` · CVE record: code-projects Vehicle Showroom Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Vehicle Showroom Management System MonthTotalReportUpdateFunction.php sql injection](https://agentprime.io/advisories/CVE-2026-6148.md) `CVE-2026-6148` · CVE record: code-projects Vehicle Showroom Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection - [tushar-2223 Hotel Management System roomdelete.php sql injection](https://agentprime.io/advisories/CVE-2026-6142.md) `CVE-2026-6142` · CVE record: tushar-2223 Hotel Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection - [Warm-Flow has a SpEL Expression Injection in SpelHelper.parseExpression](https://agentprime.io/advisories/GHSA-822v-8w6h-5jxp.md) `GHSA-822v-8w6h-5jxp`, `CVE-2026-6125` · Maven `org.dromara.warm:warm-flow-plugin-modes-sb`: affected `<1.8.5`, fixed in `1.8.5` · CVSS 5.3 Medium · Not analysed yet · Published 12 Apr 2026 · Tags: Other injection, Code injection - [AstrBotDevs AstrBot MCP Endpoint tools.py add_mcp_server command injection](https://agentprime.io/advisories/CVE-2026-6118.md) `CVE-2026-6118` · CVE record: AstrBotDevs AstrBot · CVSS 5.3 Medium · Not analysed yet · Published 12 Apr 2026 · Tags: Other injection, Command injection - [MetaGPT has an eval injection in metagpt/strategy/tot.py](https://agentprime.io/advisories/GHSA-xr7v-m9px-q4qj.md) `GHSA-xr7v-m9px-q4qj`, `CVE-2026-6110`, `PYSEC-2026-2645` · PyPI `metagpt`: affected `<=0.8.2`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 12 Apr 2026 · Tags: Other injection, Code injection - [basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands](https://agentprime.io/advisories/GHSA-6v7q-wjvx-w8wg.md) `GHSA-6v7q-wjvx-w8wg` · npm `basic-ftp`: affected `<5.2.2`, fixed in `5.2.2` · CVSS 8.2 High · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection - [Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain](https://agentprime.io/advisories/GHSA-fvcv-3m26-pcqx.md) `GHSA-fvcv-3m26-pcqx`, `CVE-2026-40175` · npm `axios`: affected `<0.31.0 || >=1.0.0, <1.15.0`, fixed in `0.31.0`, `1.15.0` · CVSS 4.8 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, HTTP request smuggling, Broken access control, Server-side request forgery (SSRF) - [Apache Log4j Core: log injection in \`Rfc5424Layout\` due to silent configuration incompatibility](https://agentprime.io/advisories/GHSA-445c-vh5m-36rj.md) `GHSA-445c-vh5m-36rj`, `CVE-2026-34478` · Maven `org.apache.logging.log4j:log4j-core`: affected `>=2.21.0, <2.25.4 || >=3.0.0-beta1, <=3.0.0-beta3`, fixed in `2.25.4` · CVSS 6.9 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, CWE-684 - [HTTP client proxy tunnel headers not validated for CR/LF](https://agentprime.io/advisories/CVE-2026-1502.md) `CVE-2026-1502` · CVE record: Python Software Foundation CPython · CVSS 5.7 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection - [Vikunja has iCalendar Property Injection via CRLF in CalDAV Task Output](https://agentprime.io/advisories/GHSA-2g7h-7rqr-9p4r.md) `GHSA-2g7h-7rqr-9p4r`, `CVE-2026-35601`, `GO-2026-4951` · Go `code.vikunja.io/api`: affected `<2.3.0`, fixed in `2.3.0` · CVSS 4.1 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection - [code-projects Vehicle Showroom Management System RegisterCustomerFunction.php sql injection](https://agentprime.io/advisories/CVE-2026-6038.md) `CVE-2026-6038` · CVE record: code-projects Vehicle Showroom Management System · CVSS 6.9 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Vehicle Showroom Management System AddVehicleFunction.php sql injection](https://agentprime.io/advisories/CVE-2026-6037.md) `CVE-2026-6037` · CVE record: code-projects Vehicle Showroom Management System · CVSS 6.9 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Vehicle Showroom Management System VehicleDetailsFunction.php sql injection](https://agentprime.io/advisories/CVE-2026-6036.md) `CVE-2026-6036` · CVE record: code-projects Vehicle Showroom Management System · CVSS 6.9 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection - [CodeAstro Online Classroom updatedetailsfromstudent.php sql injection](https://agentprime.io/advisories/CVE-2026-6033.md) `CVE-2026-6033` · CVE record: CodeAstro Online Classroom · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Simple IT Discussion Forum add-category-function.php sql injection](https://agentprime.io/advisories/CVE-2026-6031.md) `CVE-2026-6031` · CVE record: code-projects Simple IT Discussion Forum · CVSS 6.9 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection - [itsourcecode Construction Management System del1.php sql injection](https://agentprime.io/advisories/CVE-2026-6030.md) `CVE-2026-6030` · CVE record: itsourcecode Construction Management System · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection - [CodeAstro Online Classroom takeassessment2.php sql injection](https://agentprime.io/advisories/CVE-2026-6010.md) `CVE-2026-6010` · CVE record: CodeAstro Online Classroom · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection - [itsourcecode Construction Management System del.php sql injection](https://agentprime.io/advisories/CVE-2026-6007.md) `CVE-2026-6007` · CVE record: itsourcecode Construction Management System · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Patient Record Management System edit_hpatient.php sql injection](https://agentprime.io/advisories/CVE-2026-6006.md) `CVE-2026-6006` · CVE record: code-projects Patient Record Management System · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Patient Record Management System hematology_print.php sql injection](https://agentprime.io/advisories/CVE-2026-6005.md) `CVE-2026-6005` · CVE record: code-projects Patient Record Management System · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Simple IT Discussion Forum delete-category.php sql injection](https://agentprime.io/advisories/CVE-2026-6004.md) `CVE-2026-6004` · CVE record: code-projects Simple IT Discussion Forum · CVSS 6.9 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Simple IT Discussion Forum crud.php sql injection](https://agentprime.io/advisories/CVE-2026-5985.md) `CVE-2026-5985` · CVE record: code-projects Simple IT Discussion Forum · CVSS 6.9 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, SQL injection - [MetaGPT has an Injection issue](https://agentprime.io/advisories/GHSA-g977-h85w-h2xj.md) `GHSA-g977-h85w-h2xj`, `CVE-2026-5970`, `PYSEC-2026-2640` · PyPI `metagpt`: affected `<=0.8.1`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, Code injection - [LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable](https://agentprime.io/advisories/CVE-2026-39962.md) `CVE-2026-39962` · CVE record: MISP MISP · CVSS 8.8 High · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection - [oma-topic: name Field in Topic Manifests (topic.json) May Allow CRLF Injection](https://agentprime.io/advisories/CVE-2026-39958.md) `CVE-2026-39958` · CVE record: AOSC-Dev oma · CVSS 5.2 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection - [code-projects Simple IT Discussion Forum topic-details.php sql injection](https://agentprime.io/advisories/CVE-2026-5961.md) `CVE-2026-5961` · CVE record: code-projects Simple IT Discussion Forum · CVSS 6.9 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, SQL injection - [OPNsense has an LDAP Injection via Unsanitized Username in Authentication](https://agentprime.io/advisories/CVE-2026-34578.md) `CVE-2026-34578` · CVE record: opnsense core · CVSS 8.2 High · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .