# Other injection.

LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Tenda F456 httpd WriteFacMac FromWriteFacMac command injection](https://agentprime.io/advisories/CVE-2026-7102.md)
  `CVE-2026-7102` · CVE record: Tenda F456 · CVSS 5.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, Command injection
- [SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection](https://agentprime.io/advisories/CVE-2026-7088.md)
  `CVE-2026-7088` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection
- [SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection](https://agentprime.io/advisories/CVE-2026-7087.md)
  `CVE-2026-7087` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection
- [likeadmin-likeshop likeadmin_php dataTable Admin API DataTableLists.php queryResult sql injection](https://agentprime.io/advisories/CVE-2026-7083.md)
  `CVE-2026-7083` · CVE record: likeadmin-likeshop likeadmin_php · CVSS 5.1 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection
- [itsourcecode Courier Management System edit_parcel.php sql injection](https://agentprime.io/advisories/CVE-2026-7077.md)
  `CVE-2026-7077` · CVE record: itsourcecode Courier Management System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection
- [itsourcecode Courier Management System edit_branch.php sql injection](https://agentprime.io/advisories/CVE-2026-7076.md)
  `CVE-2026-7076` · CVE record: itsourcecode Courier Management System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection
- [itsourcecode Construction Management System locations.php sql injection](https://agentprime.io/advisories/CVE-2026-7075.md)
  `CVE-2026-7075` · CVE record: itsourcecode Construction Management System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection
- [itsourcecode Construction Management System execute1.php sql injection](https://agentprime.io/advisories/CVE-2026-7074.md)
  `CVE-2026-7074` · CVE record: itsourcecode Construction Management System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection
- [itsourcecode Construction Management System execute.php sql injection](https://agentprime.io/advisories/CVE-2026-7073.md)
  `CVE-2026-7073` · CVE record: itsourcecode Construction Management System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection
- [CodePanda Source canteen_management_system login.php sql injection](https://agentprime.io/advisories/CVE-2026-7072.md)
  `CVE-2026-7072` · CVE record: CodePanda Source canteen_management_system · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection
- [Dynamic-Datasource has an Injection vulnerability](https://agentprime.io/advisories/GHSA-6rmm-pg23-5f8q.md)
  `GHSA-6rmm-pg23-5f8q`, `CVE-2026-7045` · Maven `com.baomidou:dynamic-datasource-spring`: affected `<=4.5.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, CWE-707
- [code-projects Inventory Management System Login sql injection](https://agentprime.io/advisories/CVE-2026-7070.md)
  `CVE-2026-7070` · CVE record: code-projects Inventory Management System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection
- [There is a cypher injection issue in LogonTracer prior to v2.0.0.](https://agentprime.io/advisories/CVE-2026-33566.md)
  `CVE-2026-33566` · CVE record: Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) LogonTracer · CVSS 5.1 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection
- [D-Link DIR-822 udhcpd DHCP Service dhcpd.c system command injection](https://agentprime.io/advisories/CVE-2026-7067.md)
  `CVE-2026-7067` · CVE record: D-Link DIR-822 · CVSS 6.9 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Other injection, Command injection
- [code-projects Employee Management System Endpoint eprocess.php sql injection](https://agentprime.io/advisories/CVE-2026-7063.md)
  `CVE-2026-7063` · CVE record: code-projects Employee Management System · CVSS 6.9 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Other injection, SQL injection
- [liyupi yu-picture MyBatis-Plus PictureServiceImpl.java PageRequest sql injection](https://agentprime.io/advisories/CVE-2026-7060.md)
  `CVE-2026-7060` · CVE record: liyupi yu-picture · CVSS 6.9 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Other injection, SQL injection
- [666ghj MiroFish Inter-Process Communication simulation_ipc.py SimulationIPCClient.send_command command injection](https://agentprime.io/advisories/CVE-2026-7058.md)
  `CVE-2026-7058` · CVE record: 666ghj MiroFish · CVSS 6.9 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Other injection, Command injection
- [tufantunc ssh-mcp index.ts shell.write command injection](https://agentprime.io/advisories/CVE-2026-7039.md)
  `CVE-2026-7039` · CVE record: tufantunc ssh-mcp · CVSS 8.5 High · Not analysed yet · Published 26 Apr 2026 · Tags: Other injection, Command injection
- [CodeAstro Online Job Portal All Jobs delete-jobs.php sql injection](https://agentprime.io/advisories/CVE-2026-7028.md)
  `CVE-2026-7028` · CVE record: CodeAstro Online Job Portal · CVSS 5.1 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Other injection, SQL injection
- [ByteDance coze-studio databaseTool database_impl.go ExecuteSQL sql injection](https://agentprime.io/advisories/CVE-2026-7023.md)
  `CVE-2026-7023` · CVE record: ByteDance coze-studio · CVSS 5.3 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Other injection, SQL injection
- [KLiK SocialMediaWebsite Private Message get_message_ajax.php sql injection](https://agentprime.io/advisories/CVE-2026-7002.md)
  `CVE-2026-7002` · CVE record: KLiK SocialMediaWebsite · CVSS 6.9 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Other injection, SQL injection
- [Envoy Query Parameter header_mutation.cc params.add injection](https://agentprime.io/advisories/CVE-2026-6994.md)
  `CVE-2026-6994` · CVE record: Envoy · CVSS 5.3 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Other injection, CWE-707
- [PicoClaw has an Injection issue in its Web Launcher Management Plane component](https://agentprime.io/advisories/GHSA-6r3x-h84w-fhxx.md)
  `GHSA-6r3x-h84w-fhxx`, `CVE-2026-6987`, `GO-2026-5187` · Go `github.com/sipeed/picoclaw`: affected `<=0.2.4`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Other injection, Command injection
- [colinhacks Zod CUID Data Type regexes.ts sql injection](https://agentprime.io/advisories/CVE-2026-6991.md)
  `CVE-2026-6991` · CVE record: colinhacks Zod · CVSS 5.3 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Other injection, SQL injection
- [Tenda F453 Telnet Service telnet TendaTelnet command injection](https://agentprime.io/advisories/CVE-2026-6989.md)
  `CVE-2026-6989` · CVE record: Tenda F453 · CVSS 5.3 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Other injection, Command injection
- [ShowDoc has an Injection vulnerability](https://agentprime.io/advisories/GHSA-fm5r-cj7v-rj2c.md)
  `GHSA-fm5r-cj7v-rj2c`, `CVE-2026-6982`, `PKSA-r6d8-qs1d-pj19` · Packagist `showdoc/showdoc`: affected `<3.8.1`, fixed in `3.8.1` · CVSS 5.3 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Other injection, SQL injection
- [Divyanshu-hash GitPilot-MCP main.py repo_path command injection](https://agentprime.io/advisories/CVE-2026-6980.md)
  `CVE-2026-6980` · CVE record: Divyanshu-hash GitPilot-MCP · CVSS 6.9 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Other injection, Command injection
- [JiZhiCMS addcache.html htmlspecialchars_decode sql injection](https://agentprime.io/advisories/CVE-2026-6978.md)
  `CVE-2026-6978` · CVE record: JiZhiCMS · CVSS 5.1 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Other injection, SQL injection
- [Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field](https://agentprime.io/advisories/GHSA-x92x-px7w-4gx4.md)
  `GHSA-x92x-px7w-4gx4`, `CVE-2026-41328`, `GO-2026-5749` · Go `github.com/dgraph-io/dgraph` and 2 more: affected `<=1.2.8`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Apr 2026 · Tags: Other injection
- [Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field](https://agentprime.io/advisories/GHSA-mrxx-39g5-ph77.md)
  `GHSA-mrxx-39g5-ph77`, `CVE-2026-41327`, `GO-2026-5516` · Go `github.com/dgraph-io/dgraph` and 2 more: affected `<=1.2.8`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Apr 2026 · Tags: Other injection
- [Kirby has XML injection in its XML creator toolkit](https://agentprime.io/advisories/GHSA-9wfj-c55w-j9qr.md)
  `GHSA-9wfj-c55w-j9qr`, `CVE-2026-32870`, `PKSA-rr97-2byk-h46m` · Packagist `getkirby/cms`: affected `<4.9.0 || >=5.0.0, <5.4.0`, fixed in `4.9.0`, `5.4.0` · CVSS 6.9 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Other injection
- [i18next-locize-backend has URL Injection via Unsanitized Path Parameters](https://agentprime.io/advisories/GHSA-mgcp-mfp8-3q45.md)
  `GHSA-mgcp-mfp8-3q45`, `CVE-2026-41885` · npm `i18next-locize-backend`: affected `<9.0.2`, fixed in `9.0.2` · CVSS 6.5 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Path traversal, Other injection
- [i18next-http-middleware: HTTP response splitting and DoS via unsanitised Content-Language header](https://agentprime.io/advisories/GHSA-c3h8-g69v-pjrg.md)
  `GHSA-c3h8-g69v-pjrg`, `CVE-2026-41683` · npm `i18next-http-middleware`: affected `<3.9.3`, fixed in `3.9.3` · CVSS 8.6 High · Not analysed yet · Published 22 Apr 2026 · Tags: Cross-site scripting (XSS), Other injection
- [xmldom has XML injection through unvalidated DocumentType serialization](https://agentprime.io/advisories/GHSA-f6ww-3ggp-fr8h.md)
  `GHSA-f6ww-3ggp-fr8h`, `CVE-2026-41674` · npm `xmldom` and 1 more: affected `<=0.6.0`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 22 Apr 2026 · Tags: Other injection
- [xmldom has XML node injection through unvalidated processing instruction serialization](https://agentprime.io/advisories/GHSA-x6wf-f3px-wcqx.md)
  `GHSA-x6wf-f3px-wcqx`, `CVE-2026-41675` · npm `xmldom` and 1 more: affected `<=0.6.0`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 22 Apr 2026 · Tags: Other injection
- [xmldom has XML node injection through unvalidated comment serialization](https://agentprime.io/advisories/GHSA-j759-j44w-7fr8.md)
  `GHSA-j759-j44w-7fr8`, `CVE-2026-41672` · npm `xmldom` and 1 more: affected `<=0.6.0`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 22 Apr 2026 · Tags: Other injection
- [fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters](https://agentprime.io/advisories/GHSA-gh4j-gqv2-49f6.md)
  `GHSA-gh4j-gqv2-49f6`, `CVE-2026-41650` · npm `fast-xml-parser`: affected `<5.7.0`, fixed in `5.7.0` · CVSS 6.1 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Other injection
- [i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns](https://agentprime.io/advisories/GHSA-q89c-q3h5-w34g.md)
  `GHSA-q89c-q3h5-w34g`, `CVE-2026-41691` · npm `i18next-http-backend`: affected `<3.0.5`, fixed in `3.0.5` · CVSS 6.5 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Path traversal, Other injection
- [PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes](https://agentprime.io/advisories/GHSA-mh6w-vxff-9wqp.md)
  `GHSA-mh6w-vxff-9wqp`, `PKSA-qccq-2pht-gg3w` · Packagist `phpunit/phpunit`: affected `>=12.5.21, <12.5.22 || >=13.1.5, <13.1.6`, fixed in `12.5.22`, `13.1.6` · CVSS 7.8 High · Not analysed yet · Published 22 Apr 2026 · Tags: Command injection, Other injection
- [LDAP DN injection](https://agentprime.io/advisories/CVE-2026-33609.md)
  `CVE-2026-33609` · CVE record: PowerDNS Authoritative · CVSS 5.3 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Other injection
- [HTTP Headers <= 1.19.2 - Authenticated (Administrator+) CRLF Injection via Custom Header Values](https://agentprime.io/advisories/CVE-2026-2717.md)
  `CVE-2026-2717` · CVE record: zinoui HTTP Headers · CVSS 5.5 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Other injection
- [Comfast CF-N1-S Endpoint mbox-config command injection](https://agentprime.io/advisories/CVE-2026-6799.md)
  `CVE-2026-6799` · CVE record: Comfast CF-N1-S · CVSS 5.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Other injection, Command injection
- [User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups](https://agentprime.io/advisories/CVE-2026-1089.md)
  `CVE-2026-1089` · CVE record: Fortra GoAnywhere MFT · CVSS 6.5 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Other injection
- [HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT](https://agentprime.io/advisories/CVE-2026-0972.md)
  `CVE-2026-0972` · CVE record: Fortra GoAnywhere MFT · CVSS 5.4 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Other injection
- [Cockpit has NoSQL Injection Through Content Aggregation Pipelines](https://agentprime.io/advisories/GHSA-5pv2-86qj-5jf9.md)
  `GHSA-5pv2-86qj-5jf9`, `CVE-2026-6626`, `PKSA-qffw-6vr2-p3h9` · Packagist `cockpit-hq/cockpit`: affected `<2.14.0`, fixed in `2.14.0` · CVSS 5.3 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Other injection, CWE-20
- [Metasoft 美特软件 MetaCRM Interface sql.jsp Statement.executeUpdate sql injection](https://agentprime.io/advisories/CVE-2026-6629.md)
  `CVE-2026-6629` · CVE record: Metasoft 美特软件 MetaCRM · CVSS 6.9 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Other injection, SQL injection
- [phili67 Ecclesia CRM Query Viewer view ValidateInput sql injection](https://agentprime.io/advisories/CVE-2026-6628.md)
  `CVE-2026-6628` · CVE record: phili67 Ecclesia CRM · CVSS 5.3 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Other injection, SQL injection
- [Langflow vulnerable to injection](https://agentprime.io/advisories/GHSA-v66p-f7x3-4794.md)
  `GHSA-v66p-f7x3-4794`, `CVE-2026-6599`, `PYSEC-2026-2569` · PyPI `langflow`: affected `<=1.8.3`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Other injection, CWE-707
- [AgentScope Vulnerable to Remote Code Injection](https://agentprime.io/advisories/GHSA-cr24-fv3h-8cjm.md)
  `GHSA-cr24-fv3h-8cjm`, `CVE-2026-6603`, `PYSEC-2026-2331` · PyPI `agentscope`: affected `<=1.0.18`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Other injection, Code injection
- [CRLF injection in silex technology, Inc. SD-330AC and others](https://agentprime.io/advisories/CVE-2026-32964.md)
  `CVE-2026-32964` · CVE record: silex technology, Inc. SD-330AC and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Other injection
- [ProjectsAndPrograms School Management System HTTP GET Parameter buslocation.php sql injection](https://agentprime.io/advisories/CVE-2026-6595.md)
  `CVE-2026-6595` · CVE record: ProjectsAndPrograms School Management System · CVSS 6.9 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Other injection, SQL injection
- [liangliangyy DjangoBlog WeChat Bot commonapi.py CommandHandler command injection](https://agentprime.io/advisories/CVE-2026-6576.md)
  `CVE-2026-6576` · CVE record: liangliangyy DjangoBlog · CVSS 5.3 Medium · Not analysed yet · Published 19 Apr 2026 · Tags: Other injection, Command injection
- [dameng100 muucmf index.html getListByPage sql injection](https://agentprime.io/advisories/CVE-2026-6562.md)
  `CVE-2026-6562` · CVE record: dameng100 muucmf · CVSS 6.9 Medium · Not analysed yet · Published 19 Apr 2026 · Tags: Other injection, SQL injection
- [MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade](https://agentprime.io/advisories/GHSA-9j88-vvj5-vhgr.md)
  `GHSA-9j88-vvj5-vhgr`, `CVE-2026-41319` · NuGet `MailKit`: affected `<4.16.0`, fixed in `4.16.0` · CVSS 6.5 Medium · Not analysed yet · Published 18 Apr 2026 · Tags: Other injection
- [PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes](https://agentprime.io/advisories/GHSA-qrr6-mg7r-m243.md)
  `GHSA-qrr6-mg7r-m243`, `CVE-2026-41570`, `PKSA-5jz8-6tcw-pbk4` · Packagist `phpunit/phpunit`: affected `>=12.5.21, <12.5.22 || >=13.1.5, <13.1.6`, fixed in `12.5.22`, `13.1.6` · CVSS 7.8 High · Not analysed yet · Published 18 Apr 2026 · Tags: Command injection, Other injection
- [FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeover](https://agentprime.io/advisories/CVE-2026-40352.md)
  `CVE-2026-40352` · CVE record: labring FastGPT · CVSS 8.8 High · Not analysed yet · Published 17 Apr 2026 · Tags: Other injection
- [FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass](https://agentprime.io/advisories/CVE-2026-40351.md)
  `CVE-2026-40351` · CVE record: labring FastGPT · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Apr 2026 · Tags: Other injection
- [Bouncy Castle has an LDAP injection](https://agentprime.io/advisories/GHSA-c3fc-8qff-9hwx.md)
  `GHSA-c3fc-8qff-9hwx`, `CVE-2026-0636` · Maven `org.bouncycastle:bcprov-jdk14` and 2 more: affected `>=1.74, <1.84`, fixed in `1.84` · CVSS 5.5 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Other injection
- [LDAP Injection in PAC4J](https://agentprime.io/advisories/CVE-2026-40459.md)
  `CVE-2026-40459` · CVE record: PAC4J PAC4J · CVSS 8.7 High · Not analysed yet · Published 17 Apr 2026 · Tags: Other injection
- [QueryMine sms GET Request Parameter deletecourse.php sql injection](https://agentprime.io/advisories/CVE-2026-6490.md)
  `CVE-2026-6490` · CVE record: QueryMine sms · CVSS 6.9 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Other injection, SQL injection

Newest: <https://agentprime.io/advisories/tag/injection.md>
Older: <https://agentprime.io/advisories/tag/injection.md?cursor=WyIyMDI2LTA0LTE3VDEzOjE1OjExLjEzNjAwMFoiLCJDVkUtMjAyNi02NDkwIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=injection&cursor=WyIyMDI2LTA0LTI3VDEwOjE1OjExLjgxMzAwMFoiLCJDVkUtMjAyNi03MTE0Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/injection/?cursor=WyIyMDI2LTA0LTI3VDEwOjE1OjExLjgxMzAwMFoiLCJDVkUtMjAyNi03MTE0Il0>. Everything for agents: <https://agentprime.io/llms.txt>.