# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [itsourcecode Courier Management System manage_user.php sql injection](https://agentprime.io/advisories/CVE-2026-9606.md) `CVE-2026-9606` · CVE record: itsourcecode Courier Management System · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections](https://agentprime.io/advisories/CVE-2026-46740.md) `CVE-2026-46740` · CVE record: RRWO Mojolicious::Plugin::Statsd · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, CWE-150 - [code-projects Project Management System Login chk.php sql injection](https://agentprime.io/advisories/CVE-2026-9584.md) `CVE-2026-9584` · CVE record: code-projects Project Management System · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [itsourcecode Student Transcript Processing System index.php sql injection](https://agentprime.io/advisories/CVE-2026-9575.md) `CVE-2026-9575` · CVE record: itsourcecode Student Transcript Processing System · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [itsourcecode Student Transcript Processing System trans.php sql injection](https://agentprime.io/advisories/CVE-2026-9574.md) `CVE-2026-9574` · CVE record: itsourcecode Student Transcript Processing System · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [itsourcecode Student Transcript Processing System index.php sql injection](https://agentprime.io/advisories/CVE-2026-9573.md) `CVE-2026-9573` · CVE record: itsourcecode Student Transcript Processing System · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [ThingsBoard YAML provision getGatewayDockerComposeFile code injection](https://agentprime.io/advisories/CVE-2026-9568.md) `CVE-2026-9568` · CVE record: ThingsBoard · CVSS 2.3 Low · Not analysed yet · Published 26 May 2026 · Tags: Other injection, Code injection - [Das Parking Management System 停车场管理系统 Search API Endpoint sql injection](https://agentprime.io/advisories/CVE-2026-9552.md) `CVE-2026-9552` · CVE record: Das Parking Management System 停车场管理系统 · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [Das Parking Management System 停车场管理系统 API Endpoint ExportParkingRecords xp_cmdshell sql injection](https://agentprime.io/advisories/CVE-2026-9551.md) `CVE-2026-9551` · CVE record: Das Parking Management System 停车场管理系统 · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability](https://agentprime.io/advisories/GHSA-g283-w6fp-c4fc.md) `GHSA-g283-w6fp-c4fc`, `CVE-2026-46745`, `PYSEC-2026-2366` · PyPI `apache-airflow-providers-fab`: affected `<3.6.4`, fixed in `3.6.4` · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection - [hermes-agent has an Injection issue](https://agentprime.io/advisories/GHSA-pgp4-xr4j-h5cg.md) `GHSA-pgp4-xr4j-h5cg`, `CVE-2026-9366`, `PYSEC-2026-2514` · PyPI `hermes-agent`: affected `<0.15.0`, fixed in `0.15.0` · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, CWE-707 - [hermes-agent has an Injection issue](https://agentprime.io/advisories/GHSA-238w-f66p-w349.md) `GHSA-238w-f66p-w349`, `CVE-2026-9353`, `PYSEC-2026-2509` · PyPI `hermes-agent`: affected `<0.15.0`, fixed in `0.15.0` · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, CWE-707 - [Apache CXF has an LDAP injection vulnerability](https://agentprime.io/advisories/GHSA-pg32-686q-qh6x.md) `GHSA-pg32-686q-qh6x`, `CVE-2026-44930` · Maven `org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap`: affected `>=4.2.0, <4.2.1 || >=4.1.0, <4.1.6 || <3.6.11`, fixed in `4.2.1`, `4.1.6`, `3.6.11` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 May 2026 · Tags: Other injection - [Shenzhen Sixun Software Sixun Shanghui Group Business Management System PayConfig sql injection](https://agentprime.io/advisories/CVE-2026-9544.md) `CVE-2026-9544` · CVE record: Shenzhen Sixun Software Sixun Shanghui Group Business Management System · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [CodeAstro Leave Management System add_staff.php sql injection](https://agentprime.io/advisories/CVE-2026-9542.md) `CVE-2026-9542` · CVE record: CodeAstro Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [itsourcecode Electronic Judging System delete_judge.php sql injection](https://agentprime.io/advisories/CVE-2026-9528.md) `CVE-2026-9528` · CVE record: itsourcecode Electronic Judging System · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [itsourcecode Electronic Judging System edit_team.php sql injection](https://agentprime.io/advisories/CVE-2026-9526.md) `CVE-2026-9526` · CVE record: itsourcecode Electronic Judging System · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [itsourcecode Electronic Judging System edit_judge.php sql injection](https://agentprime.io/advisories/CVE-2026-9525.md) `CVE-2026-9525` · CVE record: itsourcecode Electronic Judging System · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [xianrendzw EasyReport REST Endpoint execute sql injection](https://agentprime.io/advisories/CVE-2026-9524.md) `CVE-2026-9524` · CVE record: xianrendzw EasyReport · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform getCalcmeterDetailDayListTree sql injection](https://agentprime.io/advisories/CVE-2026-9523.md) `CVE-2026-9523` · CVE record: Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [yashpokharna2555 StudentManagementSystem studentdel.php confirm_logged_in sql injection](https://agentprime.io/advisories/CVE-2026-9474.md) `CVE-2026-9474` · CVE record: yashpokharna2555 StudentManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection - [yashpokharna2555 StudentManagementSystem student_trans.php confirm_logged_in sql injection](https://agentprime.io/advisories/CVE-2026-9470.md) `CVE-2026-9470` · CVE record: yashpokharna2555 StudentManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection - [yashpokharna2555 StudentManagementSystem success.php sql injection](https://agentprime.io/advisories/CVE-2026-9469.md) `CVE-2026-9469` · CVE record: yashpokharna2555 StudentManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection - [Tiandy Easy7 Integrated Management Platform GetDBDataEx.jsp sql injection](https://agentprime.io/advisories/CVE-2026-9465.md) `CVE-2026-9465` · CVE record: Tiandy Easy7 Integrated Management Platform · CVSS 6.9 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection - [CRLF injection in WebSocket upgrade request in hackney](https://agentprime.io/advisories/GHSA-f9vr-g2g2-x9fg.md) `GHSA-f9vr-g2g2-x9fg`, `CVE-2026-47072`, `EEF-CVE-2026-47072` · Hex `hackney`: affected `>=2.0.0, <4.0.1`, fixed in `4.0.1` · CVSS 6.9 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection - [CR/LF injection in query parameter in hackney](https://agentprime.io/advisories/GHSA-j9wq-vxxc-94wf.md) `GHSA-j9wq-vxxc-94wf`, `CVE-2026-47075`, `EEF-CVE-2026-47075` · Hex `hackney`: affected `>=0.13.1, <4.0.1`, fixed in `4.0.1` · CVSS 6.8 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection - [CRLF injection in cookie domain/path options in hackney](https://agentprime.io/advisories/GHSA-mp55-p8c9-rfw2.md) `GHSA-mp55-p8c9-rfw2`, `CVE-2026-47069`, `EEF-CVE-2026-47069` · Hex `hackney`: affected `>=0.9.0, <4.0.1`, fixed in `4.0.1` · CVSS 2.1 Low · Not analysed yet · Published 25 May 2026 · Tags: Other injection - [FoundDream miniclawd SkillsLoader skills-loader.ts which command injection](https://agentprime.io/advisories/CVE-2026-9453.md) `CVE-2026-9453` · CVE record: FoundDream miniclawd · CVSS 6.9 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, Command injection - [code-projects Employee Management System applyleaveprocess.php sql injection](https://agentprime.io/advisories/CVE-2026-9451.md) `CVE-2026-9451` · CVE record: code-projects Employee Management System · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection - [code-projects Employee Management System psubmit.php sql injection](https://agentprime.io/advisories/CVE-2026-9450.md) `CVE-2026-9450` · CVE record: code-projects Employee Management System · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection - [code-projects Employee Management System changepassemp.php sql injection](https://agentprime.io/advisories/CVE-2026-9449.md) `CVE-2026-9449` · CVE record: code-projects Employee Management System · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection - [SourceCodester Simple POS and Inventory System search.php sql injection](https://agentprime.io/advisories/CVE-2026-9447.md) `CVE-2026-9447` · CVE record: SourceCodester Simple POS and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection - [SourceCodester Simple POS and Inventory System edit_customer.php sql injection](https://agentprime.io/advisories/CVE-2026-9446.md) `CVE-2026-9446` · CVE record: SourceCodester Simple POS and Inventory System · CVSS 5.1 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection - [SourceCodester Simple POS and Inventory System GET Parameter deleteproduct.php delete sql injection](https://agentprime.io/advisories/CVE-2026-9444.md) `CVE-2026-9444` · CVE record: SourceCodester Simple POS and Inventory System · CVSS 5.1 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection - [Edimax BR-6478AC POST Request formiNICbasic command injection](https://agentprime.io/advisories/CVE-2026-9441.md) `CVE-2026-9441` · CVE record: Edimax BR-6478AC · CVSS 5.3 Medium · EPSS 0.15 · Not analysed yet · Published 25 May 2026 · Tags: Other injection, Command injection - [Edimax BR-6478AC POST Request formAccept command injection](https://agentprime.io/advisories/CVE-2026-9440.md) `CVE-2026-9440` · CVE record: Edimax BR-6478AC · CVSS 5.3 Medium · EPSS 0.17 · Not analysed yet · Published 25 May 2026 · Tags: Other injection, Command injection - [Edimax BR-6675nD stainfo command injection](https://agentprime.io/advisories/CVE-2026-9439.md) `CVE-2026-9439` · CVE record: Edimax BR-6675nD · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, Command injection - [Edimax BR-6675nD POST Request mp command injection](https://agentprime.io/advisories/CVE-2026-9423.md) `CVE-2026-9423` · CVE record: Edimax BR-6675nD · CVSS 5.1 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, Command injection - [KLiK SocialMediaWebsite HTTP POST Request Parameter injection](https://agentprime.io/advisories/CVE-2026-9422.md) `CVE-2026-9422` · CVE record: KLiK SocialMediaWebsite · CVSS 6.9 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, CWE-707 - [KLiK SocialMediaWebsite HTTP GET Request Parameter injection](https://agentprime.io/advisories/CVE-2026-9420.md) `CVE-2026-9420` · CVE record: KLiK SocialMediaWebsite · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, CWE-707 - [SourceCodester Indian Invoicing System Invoice Generation IGST_Invoice.php sql injection](https://agentprime.io/advisories/CVE-2026-9411.md) `CVE-2026-9411` · CVE record: SourceCodester Indian Invoicing System · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection - [Edimax BR-6675nD POST Request formWlanMP command injection](https://agentprime.io/advisories/CVE-2026-9402.md) `CVE-2026-9402` · CVE record: Edimax BR-6675nD · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, Command injection - [Edimax BR-6675nD POST Request formUSBStorage command injection](https://agentprime.io/advisories/CVE-2026-9400.md) `CVE-2026-9400` · CVE record: Edimax BR-6675nD · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, Command injection - [itsourcecode Electronic Judging System login.php sql injection](https://agentprime.io/advisories/CVE-2026-9383.md) `CVE-2026-9383` · CVE record: itsourcecode Electronic Judging System · CVSS 6.9 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, SQL injection - [Edimax BR-6675nD POST Request formWpsStart command injection](https://agentprime.io/advisories/CVE-2026-9379.md) `CVE-2026-9379` · CVE record: Edimax BR-6675nD · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, Command injection - [Edimax BR-6675nD POST Request formHwSet command injection](https://agentprime.io/advisories/CVE-2026-9378.md) `CVE-2026-9378` · CVE record: Edimax BR-6675nD · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, Command injection - [projectworlds Online Art Gallery Shop adminHome.php sql injection](https://agentprime.io/advisories/CVE-2026-9364.md) `CVE-2026-9364` · CVE record: projectworlds Online Art Gallery Shop · CVSS 6.9 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, SQL injection - [Edimax EW-7438RPn POST Request formEZCHNwlanSetu formEZCHNwlanSetup command injection](https://agentprime.io/advisories/CVE-2026-9363.md) `CVE-2026-9363` · CVE record: Edimax EW-7438RPn · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, Command injection - [Edimax EW-7438RPn Setting formConnectionSetting command injection](https://agentprime.io/advisories/CVE-2026-9362.md) `CVE-2026-9362` · CVE record: Edimax EW-7438RPn · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, Command injection - [Edimax EW-7438RPn POST Request formAccep formAccept command injection](https://agentprime.io/advisories/CVE-2026-9361.md) `CVE-2026-9361` · CVE record: Edimax EW-7438RPn · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, Command injection - [Edimax EW-7438RPn POST Request formHwSet command injection](https://agentprime.io/advisories/CVE-2026-9359.md) `CVE-2026-9359` · CVE record: Edimax EW-7438RPn · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, Command injection - [SourceCodester Hospitals Patient Records Management System manage_history.php sql injection](https://agentprime.io/advisories/CVE-2026-9356.md) `CVE-2026-9356` · CVE record: SourceCodester Hospitals Patient Records Management System · CVSS 6.9 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, SQL injection - [SourceCodester Hospitals Patient Records Management System Master.php save_patient_history sql injection](https://agentprime.io/advisories/CVE-2026-9355.md) `CVE-2026-9355` · CVE record: SourceCodester Hospitals Patient Records Management System · CVSS 6.9 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, SQL injection - [NousResearch hermes-agent Slack Agent/Mattermost Agent escape output](https://agentprime.io/advisories/CVE-2026-9354.md) `CVE-2026-9354` · CVE record: NousResearch hermes-agent · CVSS 6.9 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, CWE-116 - [SourceCodester Hospitals Patient Records Management System view_history.php sql injection](https://agentprime.io/advisories/CVE-2026-9342.md) `CVE-2026-9342` · CVE record: SourceCodester Hospitals Patient Records Management System · CVSS 5.3 Medium · Not analysed yet · Published 23 May 2026 · Tags: Other injection, SQL injection - [QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection](https://agentprime.io/advisories/CVE-2026-9305.md) `CVE-2026-9305` · CVE record: QuantumNous new-api · CVSS 5.3 Medium · Not analysed yet · Published 23 May 2026 · Tags: Other injection, SQL injection - [546669204 vps-inventory-monitoring VpsTest Console VpsTest.php eval code injection](https://agentprime.io/advisories/CVE-2026-9302.md) `CVE-2026-9302` · CVE record: 546669204 vps-inventory-monitoring · CVSS 5.3 Medium · Not analysed yet · Published 23 May 2026 · Tags: Other injection, Code injection - [Edimax BR-6428NS POST Request formWlbasic command injection](https://agentprime.io/advisories/CVE-2026-9297.md) `CVE-2026-9297` · CVE record: Edimax BR-6428NS · CVSS 5.3 Medium · Not analysed yet · Published 23 May 2026 · Tags: Other injection, Command injection - [Edimax BR-6428NS POST Request formWlanM system command injection](https://agentprime.io/advisories/CVE-2026-9296.md) `CVE-2026-9296` · CVE record: Edimax BR-6428NS · CVSS 5.3 Medium · Not analysed yet · Published 23 May 2026 · Tags: Other injection, Command injection - [RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps](https://agentprime.io/advisories/CVE-2026-41073.md) `CVE-2026-41073` · CVE record: bestpractical rt · CVSS 4.6 Medium · Not analysed yet · Published 22 May 2026 · Tags: Other injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .