# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions](https://agentprime.io/advisories/GHSA-34r5-q4jw-r36m.md) `GHSA-34r5-q4jw-r36m`, `CVE-2026-46490` · npm `samlify`: affected `<2.13.0`, fixed in `2.13.0` · CVSS 8.7 High · Not analysed yet · Published 21 May 2026 · Tags: Other injection - [LDAP filter injection](https://agentprime.io/advisories/CVE-2026-44063.md) `CVE-2026-44063` · CVE record: Netatalk Netatalk · CVSS 4.2 Medium · Not analysed yet · Published 21 May 2026 · Tags: Other injection - [Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler](https://agentprime.io/advisories/CVE-2026-6279.md) `CVE-2026-6279` · CVE record: themefusion Avada (Fusion) Builder · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 May 2026 · Tags: Other injection - [authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation](https://agentprime.io/advisories/CVE-2026-40165.md) `CVE-2026-40165` · CVE record: goauthentik authentik · CVSS 8.7 High · Not analysed yet · Published 20 May 2026 · Tags: Other injection, Authentication bypass, CWE-436 - [Plane: ORM Field Reference Injection via \`segment\` Parameter in Saved Analytics](https://agentprime.io/advisories/CVE-2026-40102.md) `CVE-2026-40102` · CVE record: makeplane plane · CVSS 6.5 Medium · Not analysed yet · Published 20 May 2026 · Tags: Other injection - [Injection in Cisco ThousandEyes Enterprise Agent](https://agentprime.io/advisories/CVE-2026-20199.md) `CVE-2026-20199` · CVE record: Cisco Cisco ThousandEyes Enterprise Agent · CVSS 4.7 Medium · Not analysed yet · Published 20 May 2026 · Tags: Other injection - [Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction](https://agentprime.io/advisories/CVE-2026-41919.md) `CVE-2026-41919` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Other injection - [OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages](https://agentprime.io/advisories/GHSA-8rrq-wcg8-cv5q.md) `GHSA-8rrq-wcg8-cv5q`, `CVE-2026-45679`, `GO-2026-5265` · Go `go.opentelemetry.io/obi`: affected `<0.9.0`, fixed in `0.9.0` · CVSS 6.5 Medium · Not analysed yet · Published 18 May 2026 · Tags: Other injection, Information disclosure - [Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections](https://agentprime.io/advisories/CVE-2026-8788.md) `CVE-2026-8788` · CVE record: RRWO Net::Statsd::Lite · CVSS 7.3 High · Not analysed yet · Published 18 May 2026 · Tags: Other injection, CWE-150 - [projectworlds hospital-management-system-in-php GET Parameter update_info.php getAllPatientDetail sql injection](https://agentprime.io/advisories/CVE-2026-8785.md) `CVE-2026-8785` · CVE record: projectworlds hospital-management-system-in-php · CVSS 6.9 Medium · Not analysed yet · Published 18 May 2026 · Tags: Other injection, SQL injection - [Edimax BR-6428NS POST Request formStaDrvSetup command injection](https://agentprime.io/advisories/CVE-2026-8777.md) `CVE-2026-8777` · CVE record: Edimax BR-6428NS · CVSS 5.3 Medium · Not analysed yet · Published 18 May 2026 · Tags: Other injection, Command injection - [org.linlinjava:litemall-wx-api has an Injection issue](https://agentprime.io/advisories/GHSA-cvwm-vwhp-22jx.md) `GHSA-cvwm-vwhp-22jx`, `CVE-2026-8771` · Maven `org.linlinjava:litemall-wx-api`: affected `<=0.1.0`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 18 May 2026 · Tags: Other injection, SQL injection - [Edimax BR-6228NC POST Request mp command injection](https://agentprime.io/advisories/CVE-2026-8774.md) `CVE-2026-8774` · CVE record: Edimax BR-6228NC · CVSS 5.3 Medium · Not analysed yet · Published 18 May 2026 · Tags: Other injection, Command injection - [linlinjava litemall Database Setting DbUtil.java load argument injection](https://agentprime.io/advisories/CVE-2026-8773.md) `CVE-2026-8773` · CVE record: linlinjava litemall · CVSS 5.1 Medium · Not analysed yet · Published 18 May 2026 · Tags: Other injection, Command injection - [linlinjava litemall Admin Endpoint sql injection](https://agentprime.io/advisories/CVE-2026-8772.md) `CVE-2026-8772` · CVE record: linlinjava litemall · CVSS 5.1 Medium · Not analysed yet · Published 17 May 2026 · Tags: Other injection, SQL injection - [Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections](https://agentprime.io/advisories/CVE-2026-46720.md) `CVE-2026-46720` · CVE record: RRWO Net::Statsd::Tiny · CVSS 8.2 High · Not analysed yet · Published 17 May 2026 · Tags: Other injection, CWE-150 - [kalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injection](https://agentprime.io/advisories/CVE-2026-8753.md) `CVE-2026-8753` · CVE record: kalcaddle Kodbox · CVSS 5.3 Medium · Not analysed yet · Published 17 May 2026 · Tags: Other injection, Command injection - [Oinone Pamirs queryListByWrapper RSQLToSQLNodeConnector.makeVariable sql injection](https://agentprime.io/advisories/CVE-2026-8734.md) `CVE-2026-8734` · CVE record: Oinone Pamirs · CVSS 6.9 Medium · Not analysed yet · Published 17 May 2026 · Tags: Other injection, SQL injection - [Dataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injection](https://agentprime.io/advisories/CVE-2026-8724.md) `CVE-2026-8724` · CVE record: Dataease · CVSS 5.1 Medium · Not analysed yet · Published 17 May 2026 · Tags: Other injection, SQL injection - [Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections](https://agentprime.io/advisories/CVE-2026-46719.md) `CVE-2026-46719` · CVE record: RRWO Net::Statsd::Lite · CVSS 6.5 Medium · Not analysed yet · Published 16 May 2026 · Tags: Other injection, CWE-150 - [Marten has an injection vulnerability in its full-text search regConfig parameter](https://agentprime.io/advisories/GHSA-vmw2-qwm8-x84c.md) `GHSA-vmw2-qwm8-x84c`, `CVE-2026-45288` · NuGet `Marten`: affected `<8.37.0`, fixed in `8.37.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2026 · Tags: Other injection, SQL injection - [Strapi may leak sensitive data via relational filtering due to lack of query sanitization](https://agentprime.io/advisories/GHSA-rjg2-95x7-8qmx.md) `GHSA-rjg2-95x7-8qmx`, `CVE-2026-27886` · npm `@strapi/strapi`: affected `>=4.0.0, <5.37.0`, fixed in `5.37.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2026 · Tags: Path traversal, Information disclosure, Other injection - [CRLF injection in WebPros cPanel and others](https://agentprime.io/advisories/CVE-2026-32993.md) `CVE-2026-32993` · CVE record: WebPros cPanel and 1 more · CVSS 8.3 High · Not analysed yet · Published 13 May 2026 · Tags: Other injection - [BIG-IP Configuration utility vulnerability](https://agentprime.io/advisories/CVE-2026-40699.md) `CVE-2026-40699` · CVE record: F5 BIG-IP · CVSS 7.1 High · Not analysed yet · Published 13 May 2026 · Tags: Other injection - [Flowsint: Cypher query injection in node type on node creation](https://agentprime.io/advisories/CVE-2026-42156.md) `CVE-2026-42156` · CVE record: reconurge flowsint · CVSS 7.1 High · Not analysed yet · Published 12 May 2026 · Tags: Other injection - [Subnet Solutions PowerSYSTEM Center CRLF injection](https://agentprime.io/advisories/CVE-2026-35504.md) `CVE-2026-35504` · CVE record: Subnet Solutions PowerSYSTEM Center 2020 and 2 more · CVSS 5.1 Medium · Not analysed yet · Published 12 May 2026 · Tags: Other injection - [Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-42838.md) `CVE-2026-42838` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 5.4 Medium · Not analysed yet · Published 12 May 2026 · Tags: Other injection - [Azure Machine Learning Notebook Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-33833.md) `CVE-2026-33833` · CVE record: Microsoft Azure Machine Learning · CVSS 8.2 High · Not analysed yet · Published 12 May 2026 · Tags: Other injection - [GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-41109.md) `CVE-2026-41109` · CVE record: Microsoft Visual Studio Code · CVSS 8.8 High · Not analysed yet · Published 12 May 2026 · Tags: Other injection - [D-Link DIR-816 portForward command injection](https://agentprime.io/advisories/CVE-2026-8346.md) `CVE-2026-8346` · CVE record: D-Link DIR-816 · CVSS 5.3 Medium · Not analysed yet · Published 11 May 2026 · Tags: Other injection, Command injection - [D-Link DIR-816 singlePortForward sub_445E7C command injection](https://agentprime.io/advisories/CVE-2026-8345.md) `CVE-2026-8345` · CVE record: D-Link DIR-816 · CVSS 5.3 Medium · Not analysed yet · Published 11 May 2026 · Tags: Other injection, Command injection - [D-Link DIR-816 formDMZ.cgi sub_445E7C command injection](https://agentprime.io/advisories/CVE-2026-8344.md) `CVE-2026-8344` · CVE record: D-Link DIR-816 · CVSS 5.3 Medium · Not analysed yet · Published 11 May 2026 · Tags: Other injection, Command injection - [HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values](https://agentprime.io/advisories/CVE-2026-7010.md) `CVE-2026-7010` · CVE record: HAARG HTTP::Tiny · CVSS 6.5 Medium · Not analysed yet · Published 11 May 2026 · Tags: Other injection - [CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1](https://agentprime.io/advisories/GHSA-hv23-4qp7-8c8r.md) `GHSA-hv23-4qp7-8c8r`, `CVE-2026-43968`, `EEF-CVE-2026-43968` · Hex `cowlib`: affected `>=2.6.0, <2.16.1`, fixed in `2.16.1` · CVSS 6.3 Medium · Not analysed yet · Published 11 May 2026 · Tags: Other injection - [Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1](https://agentprime.io/advisories/GHSA-g2wm-735q-3f56.md) `GHSA-g2wm-735q-3f56`, `CVE-2026-43969`, `EEF-CVE-2026-43969` · Hex `cowlib`: affected `>=2.9.0, <2.21.0`, fixed in `2.21.0` · CVSS 2.1 Low · Not analysed yet · Published 11 May 2026 · Tags: Other injection - [KQL injection via kusto.tables.topics.mapping in kafka-sink-azure-kusto](https://agentprime.io/advisories/CVE-2026-42316.md) `CVE-2026-42316` · CVE record: Azure kafka-sink-azure-kusto · CVSS 5.9 Medium · Not analysed yet · Published 11 May 2026 · Tags: Other injection - [CSV injection in Dell ECS and others](https://agentprime.io/advisories/CVE-2026-35157.md) `CVE-2026-35157` · CVE record: Dell ECS and 1 more · CVSS 5.8 Medium · Not analysed yet · Published 11 May 2026 · Tags: Other injection - [HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation](https://agentprime.io/advisories/CVE-2025-8154.md) `CVE-2025-8154` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 11 May 2026 · Tags: Other injection - [CodeAstro Online Catering Ordering System deleteorder.php sql injection](https://agentprime.io/advisories/CVE-2026-8231.md) `CVE-2026-8231` · CVE record: CodeAstro Online Catering Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 10 May 2026 · Tags: Other injection, SQL injection - [codelibs Fess JSP File AdminDesignAction.java update code injection](https://agentprime.io/advisories/CVE-2026-8211.md) `CVE-2026-8211` · CVE record: codelibs Fess · CVSS 5.1 Medium · Not analysed yet · Published 9 May 2026 · Tags: Other injection, Code injection - [aandrew-me tgpt Update helper.go helper.Update command injection](https://agentprime.io/advisories/CVE-2026-8210.md) `CVE-2026-8210` · CVE record: aandrew-me tgpt · CVSS 4.8 Medium · Not analysed yet · Published 9 May 2026 · Tags: Other injection, Command injection - [Hono has CSS Declaration Injection via Style Object Values in JSX SSR](https://agentprime.io/advisories/GHSA-qp7p-654g-cw7p.md) `GHSA-qp7p-654g-cw7p`, `CVE-2026-44458` · npm `hono`: affected `<4.12.18`, fixed in `4.12.18` · CVSS 4.3 Medium · Not analysed yet · Published 9 May 2026 · Tags: Other injection, CWE-116 - [eventsource-encoder vulnerable to SSE event injection via unsanitized \`event\` and \`id\` fields](https://agentprime.io/advisories/GHSA-m9g3-3g99-mhpx.md) `GHSA-m9g3-3g99-mhpx`, `CVE-2026-44214` · npm `eventsource-encoder`: affected `<1.0.2`, fixed in `1.0.2` · CVSS 5.8 Medium · Not analysed yet · Published 8 May 2026 · Tags: Other injection - [ZITADEL has LDAP Filter Injection in Login Flow](https://agentprime.io/advisories/GHSA-rxvx-hhpj-q6px.md) `GHSA-rxvx-hhpj-q6px`, `CVE-2026-44671`, `GO-2026-5648` · Go `github.com/zitadel/zitadel`: affected `>=2.71.11, <=2.71.19 || >=3.1.0, <3.4.10 || >=4.0.0, <4.15.0`, fixed in `3.4.10`, `4.15.0` · CVSS 7.5 High · Not analysed yet · Published 8 May 2026 · Tags: Other injection - [fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes](https://agentprime.io/advisories/GHSA-5wm8-gmm8-39j9.md) `GHSA-5wm8-gmm8-39j9`, `CVE-2026-44665` · npm `fast-xml-builder`: affected `<1.1.7`, fixed in `1.1.7` · CVSS 6.1 Medium · Not analysed yet · Published 8 May 2026 · Tags: Other injection, XML external entities (XXE) - [fast-xml-builder Comment Value regex can be bypassed](https://agentprime.io/advisories/GHSA-45c6-75p6-83cc.md) `GHSA-45c6-75p6-83cc`, `CVE-2026-44664` · npm `fast-xml-builder`: affected `>=1.1.5, <1.1.6`, fixed in `1.1.6` · CVSS 6.1 Medium · Not analysed yet · Published 8 May 2026 · Tags: Other injection - [Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields](https://agentprime.io/advisories/CVE-2025-67486.md) `CVE-2025-67486` · CVE record: Dolibarr dolibarr · CVSS 8.6 High · Not analysed yet · Published 8 May 2026 · Tags: Other injection - [zyx0814 FilePress Shares Filelist API admin.php sql injection](https://agentprime.io/advisories/CVE-2026-8133.md) `CVE-2026-8133` · CVE record: zyx0814 FilePress · CVSS 6.9 Medium · Not analysed yet · Published 8 May 2026 · Tags: Other injection, SQL injection - [CodeAstro Leave Management System login.php sql injection](https://agentprime.io/advisories/CVE-2026-8132.md) `CVE-2026-8132` · CVE record: CodeAstro Leave Management System · CVSS 6.9 Medium · Not analysed yet · Published 8 May 2026 · Tags: Other injection, SQL injection - [SourceCodester SUP Online Shopping replymsg.php sql injection](https://agentprime.io/advisories/CVE-2026-8131.md) `CVE-2026-8131` · CVE record: SourceCodester SUP Online Shopping · CVSS 6.9 Medium · Not analysed yet · Published 8 May 2026 · Tags: Other injection, SQL injection - [SourceCodester SUP Online Shopping message.php sql injection](https://agentprime.io/advisories/CVE-2026-8130.md) `CVE-2026-8130` · CVE record: SourceCodester SUP Online Shopping · CVSS 6.9 Medium · Not analysed yet · Published 8 May 2026 · Tags: Other injection, SQL injection - [SourceCodester SUP Online Shopping wishlist.php sql injection](https://agentprime.io/advisories/CVE-2026-8129.md) `CVE-2026-8129` · CVE record: SourceCodester SUP Online Shopping · CVSS 6.9 Medium · Not analysed yet · Published 8 May 2026 · Tags: Other injection, SQL injection - [SourceCodester SUP Online Shopping viewmsg.php sql injection](https://agentprime.io/advisories/CVE-2026-8128.md) `CVE-2026-8128` · CVE record: SourceCodester SUP Online Shopping · CVSS 6.9 Medium · Not analysed yet · Published 8 May 2026 · Tags: Other injection, SQL injection - [SourceCodester Comment System post_comment.php sql injection](https://agentprime.io/advisories/CVE-2026-8126.md) `CVE-2026-8126` · CVE record: SourceCodester Comment System · CVSS 6.9 Medium · Not analysed yet · Published 8 May 2026 · Tags: Other injection, SQL injection - [code-projects Simple Chat System sendMessage.php sql injection](https://agentprime.io/advisories/CVE-2026-8125.md) `CVE-2026-8125` · CVE record: code-projects Simple Chat System · CVSS 5.3 Medium · Not analysed yet · Published 8 May 2026 · Tags: Other injection, SQL injection - [JeecgBoot JSON Object loadTreeData sql injection](https://agentprime.io/advisories/CVE-2026-8114.md) `CVE-2026-8114` · CVE record: JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 7 May 2026 · Tags: Other injection, SQL injection - [M365 Copilot Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-26164.md) `CVE-2026-26164` · CVE record: Microsoft Microsoft 365 Copilot's Business Chat · CVSS 7.5 High · Not analysed yet · Published 7 May 2026 · Tags: Other injection - [code-projects Feedback System checklogin.php sql injection](https://agentprime.io/advisories/CVE-2026-8098.md) `CVE-2026-8098` · CVE record: code-projects Feedback System · CVSS 6.9 Medium · Not analysed yet · Published 7 May 2026 · Tags: Other injection, SQL injection - [CodeAstro Online Classroom askquery.php sql injection](https://agentprime.io/advisories/CVE-2026-8097.md) `CVE-2026-8097` · CVE record: CodeAstro Online Classroom · CVSS 5.3 Medium · Not analysed yet · Published 7 May 2026 · Tags: Other injection, SQL injection - [SourceCodester Pharmacy Sales and Inventory System ajax.php save_user sql injection](https://agentprime.io/advisories/CVE-2026-8083.md) `CVE-2026-8083` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 7 May 2026 · Tags: Other injection, SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .