# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Netty Redis Codec Encoder has a CRLF Injection Issue](https://agentprime.io/advisories/GHSA-rgrr-p7gp-5xj7.md) `GHSA-rgrr-p7gp-5xj7`, `CVE-2026-42586` · Maven `io.netty:netty-codec-redis`: affected `>=4.2.0.Alpha1, <4.2.13.Final || <4.1.133.Final`, fixed in `4.2.13.Final`, `4.1.133.Final` · CVSS 6.8 Medium · Not analysed yet · Published 7 May 2026 · Tags: Other injection - [Netty has HTTP Header Injection via HttpProxyHandler Disabled Validation (Incomplete Fix CVE-2025-67735)](https://agentprime.io/advisories/GHSA-45q3-82m4-75jr.md) `GHSA-45q3-82m4-75jr`, `CVE-2026-42578` · Maven `io.netty:netty-handler-proxy`: affected `<4.1.133.Final || >=4.2.0.Alpha1, <4.2.13.Final`, fixed in `4.1.133.Final`, `4.2.13.Final` · CVSS 2.9 Low · Not analysed yet · Published 7 May 2026 · Tags: Other injection - [hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection](https://agentprime.io/advisories/GHSA-69xw-7hcm-h432.md) `GHSA-69xw-7hcm-h432`, `CVE-2026-44455` · npm `hono`: affected `<4.12.16`, fixed in `4.12.16` · CVSS 4.7 Medium · Not analysed yet · Published 6 May 2026 · Tags: Other injection - [ShellHub has crash-DoS via field injection in filter and sort-by parameters](https://agentprime.io/advisories/GHSA-47r2-v3x6-wff9.md) `GHSA-47r2-v3x6-wff9`, `CVE-2026-44425`, `GO-2026-5113` · Go `github.com/shellhub-io/shellhub`: affected `<0.24.2`, fixed in `0.24.2` · CVSS 5.4 Medium · Not analysed yet · Published 6 May 2026 · Tags: Other injection, Denial of service, CWE-20 - [wger: CSV/TSV formula injection in gym member export (first_name/last_name)](https://agentprime.io/advisories/GHSA-xq9m-hmp9-fw87.md) `GHSA-xq9m-hmp9-fw87`, `CVE-2026-86257` · PyPI `wger`: affected `<2.6`, fixed in `2.6` · CVSS 4.8 Medium · Not analysed yet · Published 6 May 2026 · Tags: Other injection - [Lemur: LDAP Filter Injection enables post-authentication privilege escalation](https://agentprime.io/advisories/GHSA-3r34-vq8m-39gh.md) `GHSA-3r34-vq8m-39gh`, `CVE-2026-44304`, `PYSEC-2026-2585` · PyPI `lemur`: affected `<1.9.0`, fixed in `1.9.0` · CVSS 8.1 High · Not analysed yet · Published 6 May 2026 · Tags: Other injection - [sse-channel: SSE Injection via unsanitized event fields](https://agentprime.io/advisories/GHSA-84hm-wfh8-c5pg.md) `GHSA-84hm-wfh8-c5pg`, `CVE-2026-44217` · npm `sse-channel`: affected `<4.0.1`, fixed in `4.0.1` · CVSS 6.6 Medium · Not analysed yet · Published 5 May 2026 · Tags: Other injection - [AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing](https://agentprime.io/advisories/GHSA-mwgh-92m2-wvhv.md) `GHSA-mwgh-92m2-wvhv`, `CVE-2026-43882`, `PKSA-81bf-8cfg-hbh2` · Packagist `wwbn/avideo`: affected `<=29.0`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 5 May 2026 · Tags: Other injection - [Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection](https://agentprime.io/advisories/GHSA-wpg9-53fq-2r8h.md) `GHSA-wpg9-53fq-2r8h`, `BIT-mongoose-2026-42334`, `CVE-2026-42334` · npm `mongoose`: affected `<6.13.9 || >=7.0.0, <7.8.9 || >=8.0.0, <8.22.1 || >=9.0.0, <9.1.6`, fixed in `6.13.9`, `7.8.9`, `8.22.1`, `9.1.6` · CVSS 7.5 High · Not analysed yet · Published 5 May 2026 · Tags: Other injection - [Kimai vulnerable to formula Injection via tag names in XLSX export](https://agentprime.io/advisories/GHSA-3xc2-h5r3-wv3r.md) `GHSA-3xc2-h5r3-wv3r`, `CVE-2026-42267`, `PKSA-z4ky-h9pc-hn66` · Packagist `kimai/kimai`: affected `>=2.27.0, <2.54.0`, fixed in `2.54.0` · CVSS 5.4 Medium · Not analysed yet · Published 5 May 2026 · Tags: Other injection - [Pi-hole FTL remote code execution via newline injection in dns.interface configuration](https://agentprime.io/advisories/CVE-2026-39849.md) `CVE-2026-39849` · CVE record: pi-hole FTL · CVSS 8.7 High · Not analysed yet · Published 5 May 2026 · Tags: Other injection - [Sandboxie-Plus privilege escalation via INI CRLF injection bypassing EditAdminOnly](https://agentprime.io/advisories/CVE-2026-34458.md) `CVE-2026-34458` · CVE record: sandboxie-plus Sandboxie · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2026 · Tags: Other injection - [Microdot has HTTP response splitting in Response.set_cookie()](https://agentprime.io/advisories/GHSA-7wc8-wvc4-m498.md) `GHSA-7wc8-wvc4-m498`, `CVE-2026-42874`, `PYSEC-2026-2646` · PyPI `microdot`: affected `<2.6.1`, fixed in `2.6.1` · CVSS 3.7 Low · Not analysed yet · Published 5 May 2026 · Tags: Other injection - [Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection](https://agentprime.io/advisories/GHSA-v8h7-rr48-vmmv.md) `GHSA-v8h7-rr48-vmmv`, `CVE-2026-41417` · Maven `io.netty:netty-codec-http`: affected `<4.1.133.Final || >=4.2.0.Alpha1, <4.2.13.Final`, fixed in `4.1.133.Final`, `4.2.13.Final` · CVSS 5.3 Medium · Not analysed yet · Published 5 May 2026 · Tags: Other injection, HTTP request smuggling - [EFM ipTIME C200 ApplyRestore Endpoint iux_set.cgi sub_408F90 command injection](https://agentprime.io/advisories/CVE-2026-7833.md) `CVE-2026-7833` · CVE record: EFM ipTIME C200 · CVSS 8.6 High · Not analysed yet · Published 5 May 2026 · Tags: Other injection, Command injection - [traccar allows XML injection in KML and GPX exports](https://agentprime.io/advisories/CVE-2026-27693.md) `CVE-2026-27693` · CVE record: traccar traccar · CVSS 5.4 Medium · Not analysed yet · Published 5 May 2026 · Tags: Other injection - [traccar allows CSV formula injection via exported position data](https://agentprime.io/advisories/CVE-2026-27644.md) `CVE-2026-27644` · CVE record: traccar traccar · CVSS 6.5 Medium · Not analysed yet · Published 5 May 2026 · Tags: Other injection - [ERPGo SaaS 3.9 CSV Injection via Vendor Creation](https://agentprime.io/advisories/CVE-2023-54348.md) `CVE-2023-54348` · CVE record: Rajodiya ERPGo SaaS · CVSS 8.7 High · Not analysed yet · Published 5 May 2026 · Tags: Other injection - [Apache Thrift vulnerable to Path Traversal, HTTP Request/Response Splitting, Uncontrolled Resource Consumption](https://agentprime.io/advisories/GHSA-526f-jxpj-jmg2.md) `GHSA-526f-jxpj-jmg2`, `BIT-thrift-2026-43870`, `CVE-2026-43870` · npm `thrift`: affected `<=0.22.0`, no fixed version yet · CVSS 7.3 High · Not analysed yet · Published 5 May 2026 · Tags: Path traversal, Other injection, Denial of service, CWE-346 - [itsourcecode Courier Management System print_pdets.php sql injection](https://agentprime.io/advisories/CVE-2026-7822.md) `CVE-2026-7822` · CVE record: itsourcecode Courier Management System · CVSS 5.3 Medium · Not analysed yet · Published 5 May 2026 · Tags: Other injection, SQL injection - [54yyyu code-mcp MCP Tool server.py git_operation command injection](https://agentprime.io/advisories/CVE-2026-7812.md) `CVE-2026-7812` · CVE record: 54yyyu code-mcp · CVSS 6.9 Medium · Not analysed yet · Published 5 May 2026 · Tags: Other injection, Command injection - [Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream](https://agentprime.io/advisories/GHSA-445q-vr5w-6q77.md) `GHSA-445q-vr5w-6q77`, `CVE-2026-42037` · npm `axios`: affected `>=1.0.0, <1.15.1`, fixed in `1.15.1` · CVSS 5.3 Medium · Not analysed yet · Published 5 May 2026 · Tags: Other injection - [Axios: Header Injection via Prototype Pollution](https://agentprime.io/advisories/GHSA-6chq-wfr3-2hj9.md) `GHSA-6chq-wfr3-2hj9`, `CVE-2026-42035` · npm `axios`: affected `<0.31.1 || >=1.0.0, <1.15.1`, fixed in `0.31.1`, `1.15.1` · CVSS 7.4 High · Not analysed yet · Published 5 May 2026 · Tags: Other injection, Prototype pollution - [CodeCanyon Perfex CRM Admin Kanban Endpoint AbstractKanban.php applySortQuery sql injection](https://agentprime.io/advisories/CVE-2026-7783.md) `CVE-2026-7783` · CVE record: CodeCanyon Perfex CRM · CVSS 5.3 Medium · Not analysed yet · Published 4 May 2026 · Tags: Other injection, SQL injection - [net-imap vulnerable to command Injection via "raw" arguments to multiple commands](https://agentprime.io/advisories/GHSA-hm49-wcqc-g2xg.md) `GHSA-hm49-wcqc-g2xg`, `CVE-2026-42257` · RubyGems `net-imap`: affected `<0.4.24 || >=0.5.0, <0.5.14 || >=0.6.0, <0.6.4`, fixed in `0.4.24`, `0.5.14`, `0.6.4` · CVSS 5.8 Medium · Not analysed yet · Published 4 May 2026 · Tags: Command injection, Other injection - [net-imap vulnerable to command Injection via unvalidated Symbol inputs](https://agentprime.io/advisories/GHSA-75xq-5h9v-w6px.md) `GHSA-75xq-5h9v-w6px`, `CVE-2026-42258` · RubyGems `net-imap`: affected `<0.4.24 || >=0.5.0, <0.5.14 || >=0.6.0, <0.6.4`, fixed in `0.4.24`, `0.5.14`, `0.6.4` · CVSS 5.8 Medium · Not analysed yet · Published 4 May 2026 · Tags: Command injection, Other injection - [SourceCodester Web-based Pharmacy Product Management System edit-admin.php sql injection](https://agentprime.io/advisories/CVE-2026-7746.md) `CVE-2026-7746` · CVE record: SourceCodester Web-based Pharmacy Product Management System · CVSS 5.3 Medium · Not analysed yet · Published 4 May 2026 · Tags: Other injection, SQL injection - [CodeAstro Online Classroom facultydetails sql injection](https://agentprime.io/advisories/CVE-2026-7745.md) `CVE-2026-7745` · CVE record: CodeAstro Online Classroom · CVSS 5.3 Medium · Not analysed yet · Published 4 May 2026 · Tags: Other injection, SQL injection - [CodeAstro Online Classroom addnewstudent sql injection](https://agentprime.io/advisories/CVE-2026-7744.md) `CVE-2026-7744` · CVE record: CodeAstro Online Classroom · CVSS 5.3 Medium · Not analysed yet · Published 4 May 2026 · Tags: Other injection, SQL injection - [CodeAstro Online Classroom studentdetails sql injection](https://agentprime.io/advisories/CVE-2026-7743.md) `CVE-2026-7743` · CVE record: CodeAstro Online Classroom · CVSS 5.3 Medium · Not analysed yet · Published 4 May 2026 · Tags: Other injection, SQL injection - [CodeAstro Online Classroom facultylogin sql injection](https://agentprime.io/advisories/CVE-2026-7742.md) `CVE-2026-7742` · CVE record: CodeAstro Online Classroom · CVSS 5.3 Medium · Not analysed yet · Published 4 May 2026 · Tags: Other injection, SQL injection - [CodeAstro Online Classroom studentlogin sql injection](https://agentprime.io/advisories/CVE-2026-7741.md) `CVE-2026-7741` · CVE record: CodeAstro Online Classroom · CVSS 5.3 Medium · Not analysed yet · Published 4 May 2026 · Tags: Other injection, SQL injection - [Prefect Git Argument Injection in GitRepository Pull Steps](https://agentprime.io/advisories/GHSA-6rcx-55r6-jx65.md) `GHSA-6rcx-55r6-jx65`, `CVE-2026-7725`, `PYSEC-2026-2955` · PyPI `prefect`: affected `<3.6.25.dev7`, fixed in `3.6.25.dev7` · CVSS 5.3 Medium · Not analysed yet · Published 4 May 2026 · Tags: Other injection, Command injection - [code-projects BloodBank Managing System get_state.php sql injection](https://agentprime.io/advisories/CVE-2026-7731.md) `CVE-2026-7731` · CVE record: code-projects BloodBank Managing System · CVSS 5.3 Medium · Not analysed yet · Published 4 May 2026 · Tags: Other injection, SQL injection - [Shandong Hoteam Software PDM Product Data Management System DataService GetQueryMachineGridOnePageData sql injection](https://agentprime.io/advisories/CVE-2026-7727.md) `CVE-2026-7727` · CVE record: Shandong Hoteam Software PDM Product Data Management System · CVSS 6.9 Medium · Not analysed yet · Published 4 May 2026 · Tags: Other injection, SQL injection - [Totolink WA300 cstecgi.cgi NTPSyncWithHost command injection](https://agentprime.io/advisories/CVE-2026-7721.md) `CVE-2026-7721` · CVE record: Totolink WA300 · CVSS 5.3 Medium · Not analysed yet · Published 4 May 2026 · Tags: Other injection, Command injection - [Totolink WA300 POST Request cstecgi.cgi setLanguageCfg command injection](https://agentprime.io/advisories/CVE-2026-7720.md) `CVE-2026-7720` · CVE record: Totolink WA300 · CVSS 5.3 Medium · Not analysed yet · Published 4 May 2026 · Tags: Other injection, Command injection - [Totolink WA300 POST Request cstecgi.cgi setWebWlanIdx command injection](https://agentprime.io/advisories/CVE-2026-7718.md) `CVE-2026-7718` · CVE record: Totolink WA300 · CVSS 5.3 Medium · Not analysed yet · Published 4 May 2026 · Tags: Other injection, Command injection - [code-projects Gym Management System In PHP/Windows NT index.php sql injection](https://agentprime.io/advisories/CVE-2026-7716.md) `CVE-2026-7716` · CVE record: code-projects Gym Management System In PHP and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 4 May 2026 · Tags: Other injection, SQL injection - [JD Cloud JDCOS Service jdcap set_iptv_info command injection](https://agentprime.io/advisories/CVE-2026-7705.md) `CVE-2026-7705` · CVE record: JD Cloud JDCOS · CVSS 5.3 Medium · Not analysed yet · Published 3 May 2026 · Tags: Other injection, Command injection - [AV Stumpfl Pixera Two Media Server Websocket API code injection](https://agentprime.io/advisories/CVE-2026-7703.md) `CVE-2026-7703` · CVE record: AV Stumpfl Pixera Two Media Server · CVSS 6.9 Medium · Not analysed yet · Published 3 May 2026 · Tags: Other injection, Code injection - [Duplicate Advisory: Prompt injection in Langflow Smart Transform can lead to code execution](https://agentprime.io/advisories/GHSA-hhxr-7j22-694r.md) `GHSA-hhxr-7j22-694r` · PyPI `langflow`: affected `>=1.3.0`, no fixed version yet · CVSS 6.3 Medium · Withdrawn · Not analysed yet · Published 3 May 2026 · Tags: Other injection - [Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection](https://agentprime.io/advisories/CVE-2026-7699.md) `CVE-2026-7699` · CVE record: Dromara MaxKey · CVSS 5.3 Medium · Not analysed yet · Published 3 May 2026 · Tags: Other injection, SQL injection - [AMTT Hotel Broadband Operation System cardhand_submit.php sql injection](https://agentprime.io/advisories/CVE-2026-7697.md) `CVE-2026-7697` · CVE record: AMTT Hotel Broadband Operation System · CVSS 5.1 Medium · Not analysed yet · Published 3 May 2026 · Tags: Other injection, SQL injection - [Dolibarr has an Injection issue](https://agentprime.io/advisories/GHSA-rvwr-q5hj-wq7g.md) `GHSA-rvwr-q5hj-wq7g`, `CVE-2026-7688`, `PKSA-zbps-xm91-whkn` · Packagist `dolibarr/dolibarr`: affected `<=23.0.2`, no fixed version yet · CVSS 2.3 Low · Not analysed yet · Published 3 May 2026 · Tags: Other injection, SQL injection - [Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform elecMaxMinAvgValue sql injection](https://agentprime.io/advisories/CVE-2026-7695.md) `CVE-2026-7695` · CVE record: Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform · CVSS 6.9 Medium · Not analysed yet · Published 3 May 2026 · Tags: Other injection, SQL injection - [Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System elecMaxMinAvgValue sql injection](https://agentprime.io/advisories/CVE-2026-7694.md) `CVE-2026-7694` · CVE record: Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System · CVSS 6.9 Medium · Not analysed yet · Published 3 May 2026 · Tags: Other injection, SQL injection - [Wavlink WL-WN570HA1 adm.cgi ping_ddns command injection](https://agentprime.io/advisories/CVE-2026-7692.md) `CVE-2026-7692` · CVE record: Wavlink WL-WN570HA1 · CVSS 5.3 Medium · Not analysed yet · Published 3 May 2026 · Tags: Other injection, Command injection - [Wavlink WL-WN570HA1 adm.cgi set_sys_cmd command injection](https://agentprime.io/advisories/CVE-2026-7691.md) `CVE-2026-7691` · CVE record: Wavlink WL-WN570HA1 · CVSS 5.3 Medium · Not analysed yet · Published 3 May 2026 · Tags: Other injection, Command injection - [Wavlink WL-WN570HA1 adm.cgi set_sys_adm command injection](https://agentprime.io/advisories/CVE-2026-7690.md) `CVE-2026-7690` · CVE record: Wavlink WL-WN570HA1 · CVSS 5.3 Medium · Not analysed yet · Published 3 May 2026 · Tags: Other injection, Command injection - [langflow-ai langflow Full Builtins code_parser.py CodeParser.parse_callable_details command injection](https://agentprime.io/advisories/CVE-2026-7687.md) `CVE-2026-7687` · CVE record: langflow-ai langflow · CVSS 5.3 Medium · Not analysed yet · Published 3 May 2026 · Tags: Other injection, Command injection - [Edimax BR-6428nC Web setWAN command injection](https://agentprime.io/advisories/CVE-2026-7683.md) `CVE-2026-7683` · CVE record: Edimax BR-6428nC · CVSS 5.3 Medium · Not analysed yet · Published 3 May 2026 · Tags: Other injection, Command injection - [Edimax BR-6208AC L2TP Mode setWAN command injection](https://agentprime.io/advisories/CVE-2026-7682.md) `CVE-2026-7682` · CVE record: Edimax BR-6208AC · CVSS 5.3 Medium · Not analysed yet · Published 3 May 2026 · Tags: Other injection, Command injection - [YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection](https://agentprime.io/advisories/CVE-2026-7678.md) `CVE-2026-7678` · CVE record: YunaiV yudao-cloud · CVSS 5.3 Medium · Not analysed yet · Published 3 May 2026 · Tags: Other injection, SQL injection - [SGLang has an Improper Input Validation/Injection Issue](https://agentprime.io/advisories/GHSA-6m5f-673f-5vh7.md) `GHSA-6m5f-673f-5vh7`, `CVE-2026-7669`, `PYSEC-2026-3062` · PyPI `sglang`: affected `<=0.5.9`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 3 May 2026 · Tags: Other injection, Code injection, CWE-20 - [youlaitech youlai-boot Users Endpoint UserController.java getUserList sql injection](https://agentprime.io/advisories/CVE-2026-7672.md) `CVE-2026-7672` · CVE record: youlaitech youlai-boot · CVSS 5.3 Medium · Not analysed yet · Published 3 May 2026 · Tags: Other injection, SQL injection - [Jinher OA UserSel.aspx sql injection](https://agentprime.io/advisories/CVE-2026-7670.md) `CVE-2026-7670` · CVE record: Jinher OA · CVSS 6.9 Medium · Not analysed yet · Published 2 May 2026 · Tags: Other injection, SQL injection - [code-projects Online Hospital Management System viewappointment.php sql injection](https://agentprime.io/advisories/CVE-2026-7632.md) `CVE-2026-7632` · CVE record: code-projects Online Hospital Management System · CVSS 6.9 Medium · Not analysed yet · Published 2 May 2026 · Tags: Other injection, SQL injection - [kleneway awesome-cursor-mpc-server Ccode-Review Tool codeReview.ts runCodeReviewTool command injection](https://agentprime.io/advisories/CVE-2026-7629.md) `CVE-2026-7629` · CVE record: kleneway awesome-cursor-mpc-server · CVSS 5.3 Medium · Not analysed yet · Published 2 May 2026 · Tags: Other injection, Command injection - [crazyrabbitLTC mcp-code-review-server RepoMix repomix.ts executeRepomix command injection](https://agentprime.io/advisories/CVE-2026-7628.md) `CVE-2026-7628` · CVE record: crazyrabbitLTC mcp-code-review-server · CVSS 5.3 Medium · Not analysed yet · Published 2 May 2026 · Tags: Other injection, Command injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .