# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [SourceCodester Computer Repair Shop Management System manage_product.php sql injection](https://agentprime.io/advisories/CVE-2026-10263.md) `CVE-2026-10263` · CVE record: SourceCodester Computer Repair Shop Management System · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [code-projects Real State Services Login loginuser.php sql injection](https://agentprime.io/advisories/CVE-2026-10262.md) `CVE-2026-10262` · CVE record: code-projects Real State Services · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [CodeAstro Online Job Portal application_status.php sql injection](https://agentprime.io/advisories/CVE-2026-10261.md) `CVE-2026-10261` · CVE record: CodeAstro Online Job Portal · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [CodeAstro Online Job Portal delete-jobs.php sql injection](https://agentprime.io/advisories/CVE-2026-10260.md) `CVE-2026-10260` · CVE record: CodeAstro Online Job Portal · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [itsourcecode Content Management System add_sub_topic.php sql injection](https://agentprime.io/advisories/CVE-2026-10258.md) `CVE-2026-10258` · CVE record: itsourcecode Content Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [itsourcecode Content Management System update_ss_img.php sql injection](https://agentprime.io/advisories/CVE-2026-10257.md) `CVE-2026-10257` · CVE record: itsourcecode Content Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [itsourcecode Content Management System save_comment.php sql injection](https://agentprime.io/advisories/CVE-2026-10256.md) `CVE-2026-10256` · CVE record: itsourcecode Content Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [itsourcecode Online House Rental System manage_payment.php sql injection](https://agentprime.io/advisories/CVE-2026-10253.md) `CVE-2026-10253` · CVE record: itsourcecode Online House Rental System · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [itsourcecode Online House Rental System manage_tenant.php sql injection](https://agentprime.io/advisories/CVE-2026-10252.md) `CVE-2026-10252` · CVE record: itsourcecode Online House Rental System · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [itsourcecode Online House Rental System ajax.php login sql injection](https://agentprime.io/advisories/CVE-2026-10251.md) `CVE-2026-10251` · CVE record: itsourcecode Online House Rental System · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Blood Bank Management System campsdetails.php sql injection](https://agentprime.io/advisories/CVE-2026-10250.md) `CVE-2026-10250` · CVE record: itsourcecode Online Blood Bank Management System · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Blood Bank Management System viewrequest.php sql injection](https://agentprime.io/advisories/CVE-2026-10249.md) `CVE-2026-10249` · CVE record: itsourcecode Online Blood Bank Management System · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [SourceCodester Pharmacy Sales and Inventory System Supplier Creation export create_supplier csv injection](https://agentprime.io/advisories/CVE-2026-10248.md) `CVE-2026-10248` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 5.1 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection - [itsourcecode Content Management System instructions.php sql injection](https://agentprime.io/advisories/CVE-2026-10242.md) `CVE-2026-10242` · CVE record: itsourcecode Content Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [SourceCodester Water Billing Management System User Management manage_user sql injection](https://agentprime.io/advisories/CVE-2026-10237.md) `CVE-2026-10237` · CVE record: SourceCodester Water Billing Management System · CVSS 5.1 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [CodeAstro Ingredients Stock Management System stock_manager.php sql injection](https://agentprime.io/advisories/CVE-2026-10235.md) `CVE-2026-10235` · CVE record: CodeAstro Ingredients Stock Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [hermes-agent has an Injection issue](https://agentprime.io/advisories/GHSA-33qv-c5qm-799v.md) `GHSA-33qv-c5qm-799v`, `CVE-2026-10223`, `PYSEC-2026-3575` · PyPI `hermes-agent`: affected `<0.15.0`, fixed in `0.15.0` · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, CWE-707 - [hermes-agent has an Injection issue](https://agentprime.io/advisories/GHSA-xq8w-9jvx-gm3v.md) `GHSA-xq8w-9jvx-gm3v`, `CVE-2026-10221`, `PYSEC-2026-3577` · PyPI `hermes-agent`: affected `<=0.19.0`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, CWE-707 - [hermes-agent has an Injection issue](https://agentprime.io/advisories/GHSA-mv8x-fg99-32mf.md) `GHSA-mv8x-fg99-32mf`, `CVE-2026-10222`, `PYSEC-2026-2513` · PyPI `hermes-agent`: affected `<0.18.0`, fixed in `0.18.0` · CVSS 6.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, CWE-707 - [raisulislamg4 student_management_system_by_php User Creation add_user_check.php sql injection](https://agentprime.io/advisories/CVE-2026-10227.md) `CVE-2026-10227` · CVE record: raisulislamg4 student_management_system_by_php · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [raisulislamg4 student_management_system_by_php delete.php sql injection](https://agentprime.io/advisories/CVE-2026-10226.md) `CVE-2026-10226` · CVE record: raisulislamg4 student_management_system_by_php · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [raisulislamg4 student_management_system_by_php Login login_check.php sql injection](https://agentprime.io/advisories/CVE-2026-10225.md) `CVE-2026-10225` · CVE record: raisulislamg4 student_management_system_by_php · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [NousResearch hermes-agent skills_tool.py skill_view injection](https://agentprime.io/advisories/CVE-2026-10220.md) `CVE-2026-10220` · CVE record: NousResearch hermes-agent · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, CWE-707 - [AstrBotDevs AstrBot skill_manager.py \_sanitize_prompt_description injection](https://agentprime.io/advisories/CVE-2026-10210.md) `CVE-2026-10210` · CVE record: AstrBotDevs AstrBot · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, CWE-707 - [code-projects Online Hospital Management System Appointment appointmentdetail.php sql injection](https://agentprime.io/advisories/CVE-2026-10209.md) `CVE-2026-10209` · CVE record: code-projects Online Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [code-projects Online Hospital Management System login_1.php login_user sql injection](https://agentprime.io/advisories/CVE-2026-10208.md) `CVE-2026-10208` · CVE record: code-projects Online Hospital Management System · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [OFCMS JSON Query SysUserController.java query sql injection](https://agentprime.io/advisories/CVE-2026-10204.md) `CVE-2026-10204` · CVE record: OFCMS · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [OFCMS JSON Query SystemParamController.java query sql injection](https://agentprime.io/advisories/CVE-2026-10203.md) `CVE-2026-10203` · CVE record: OFCMS · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [OFCMS JSON Query SystemDictController.java query sql injection](https://agentprime.io/advisories/CVE-2026-10202.md) `CVE-2026-10202` · CVE record: OFCMS · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [OFCMS ComnController ComnController.java query sql injection](https://agentprime.io/advisories/CVE-2026-10193.md) `CVE-2026-10193` · CVE record: OFCMS · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [code-projects Online Hospital Management System patient.php sql injection](https://agentprime.io/advisories/CVE-2026-10186.md) `CVE-2026-10186` · CVE record: code-projects Online Hospital Management System · CVSS 6.9 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [SourceCodester Hospitals Patient Records Management System Users.php save sql injection](https://agentprime.io/advisories/CVE-2026-10185.md) `CVE-2026-10185` · CVE record: SourceCodester Hospitals Patient Records Management System · CVSS 6.9 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [SourceCodester Hospitals Patient Records Management System Users.php delete sql injection](https://agentprime.io/advisories/CVE-2026-10184.md) `CVE-2026-10184` · CVE record: SourceCodester Hospitals Patient Records Management System · CVSS 6.9 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [TRENDnet TEW-432BRP formWlanSetup command injection](https://agentprime.io/advisories/CVE-2026-10182.md) `CVE-2026-10182` · CVE record: TRENDnet TEW-432BRP · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, Command injection - [TRENDnet TEW-432BRP formSysCmd command injection](https://agentprime.io/advisories/CVE-2026-10180.md) `CVE-2026-10180` · CVE record: TRENDnet TEW-432BRP · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, Command injection - [code-projects Online Music Site AdminEditAlbum.php sql injection](https://agentprime.io/advisories/CVE-2026-10178.md) `CVE-2026-10178` · CVE record: code-projects Online Music Site · CVSS 6.9 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [Aider is vulnerable to Code Injection via editor_coder.run function](https://agentprime.io/advisories/GHSA-7w7m-v5vp-w699.md) `GHSA-7w7m-v5vp-w699`, `CVE-2026-10175`, `PYSEC-2026-2335` · PyPI `aider-chat`: affected `<=0.86.2`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, Code injection - [Aider-AI Aider Code Generation Workflow sql injection](https://agentprime.io/advisories/CVE-2026-10176.md) `CVE-2026-10176` · CVE record: Aider-AI Aider · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [code-projects Online Music Site AdminUpdateAlbum.php sql injection](https://agentprime.io/advisories/CVE-2026-10171.md) `CVE-2026-10171` · CVE record: code-projects Online Music Site · CVSS 5.1 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [code-projects Visitor Management System phone_0.php sql injection](https://agentprime.io/advisories/CVE-2026-10170.md) `CVE-2026-10170` · CVE record: code-projects Visitor Management System · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [Edimax BR-6478AC POST Request formWlbasic command injection](https://agentprime.io/advisories/CVE-2026-10166.md) `CVE-2026-10166` · CVE record: Edimax BR-6478AC · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, Command injection - [Bdtask Multi-Store Inventory Management System Accounts Report Accounts.php accounts_report_search sql injection](https://agentprime.io/advisories/CVE-2026-10155.md) `CVE-2026-10155` · CVE record: Bdtask Multi-Store Inventory Management System · CVSS 5.1 Medium · Not analysed yet · Published 30 May 2026 · Tags: Other injection, SQL injection - [Edimax BR-6478AC POST Request formStaDrvSetup command injection](https://agentprime.io/advisories/CVE-2026-10127.md) `CVE-2026-10127` · CVE record: Edimax BR-6478AC · CVSS 5.3 Medium · Not analysed yet · Published 30 May 2026 · Tags: Other injection, Command injection - [sambitraj STUDENT-MANAGEMENT-SYSTEM Login Page sql injection](https://agentprime.io/advisories/CVE-2026-10111.md) `CVE-2026-10111` · CVE record: sambitraj STUDENT-MANAGEMENT-SYSTEM · CVSS 6.9 Medium · Not analysed yet · Published 30 May 2026 · Tags: Other injection, SQL injection - [code-projects Student Details Management System index.php sql injection](https://agentprime.io/advisories/CVE-2026-10110.md) `CVE-2026-10110` · CVE record: code-projects Student Details Management System · CVSS 6.9 Medium · Not analysed yet · Published 30 May 2026 · Tags: Other injection, SQL injection - [cpp-httplib: HTTP header value percent-decoding in server-side \`parse_header\` enables CRLF injection](https://agentprime.io/advisories/CVE-2026-45372.md) `CVE-2026-45372` · CVE record: yhirose cpp-httplib · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2026 · Tags: Other injection, HTTP request smuggling - [Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix](https://agentprime.io/advisories/GHSA-654m-c8p4-x5fp.md) `GHSA-654m-c8p4-x5fp`, `CVE-2026-44489` · npm `axios`: affected `>=1.15.2, <1.16.0`, fixed in `1.16.0` · CVSS 3.7 Low · Not analysed yet · Published 29 May 2026 · Tags: Other injection, Prototype pollution - [Froxlor has an incomplete fix for CVE-2026-30932](https://agentprime.io/advisories/GHSA-j6fm-9rfm-j5hx.md) `GHSA-j6fm-9rfm-j5hx`, `CVE-2026-41237`, `PKSA-sn72-k1q6-w5r5` · Packagist `froxlor/froxlor`: affected `<2.3.7`, fixed in `2.3.7` · CVSS 8.6 High · Not analysed yet · Published 29 May 2026 · Tags: Other injection - [XPath injection in WebPros Plesk](https://agentprime.io/advisories/CVE-2026-44962.md) `CVE-2026-44962` · CVE record: WebPros Plesk · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2026 · Tags: Other injection - [TRENDnet TEW-432BRP formWPS command injection](https://agentprime.io/advisories/CVE-2026-10061.md) `CVE-2026-10061` · CVE record: TRENDnet TEW-432BRP · CVSS 5.3 Medium · Not analysed yet · Published 29 May 2026 · Tags: Other injection, Command injection - [TRENDnet TEW-432BRP formSetRoute command injection](https://agentprime.io/advisories/CVE-2026-10060.md) `CVE-2026-10060` · CVE record: TRENDnet TEW-432BRP · CVSS 5.3 Medium · Not analysed yet · Published 29 May 2026 · Tags: Other injection, Command injection - [LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instances](https://agentprime.io/advisories/CVE-2026-45344.md) `CVE-2026-45344` · CVE record: Kovah LinkAce · CVSS 8.1 High · Not analysed yet · Published 28 May 2026 · Tags: Other injection - [Music Player Daemon < 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxx](https://agentprime.io/advisories/CVE-2026-49130.md) `CVE-2026-49130` · CVE record: MusicPlayerDaemon MPD · CVSS 6.9 Medium · Not analysed yet · Published 28 May 2026 · Tags: Other injection - [Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths](https://agentprime.io/advisories/CVE-2026-9658.md) `CVE-2026-9658` · CVE record: RRWO Plack::Middleware::Security::Common · CVSS 7.3 High · Not analysed yet · Published 28 May 2026 · Tags: Other injection, CWE-790 - [json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio](https://agentprime.io/advisories/GHSA-g27c-q7cp-mhx6.md) `GHSA-g27c-q7cp-mhx6`, `CVE-2026-9673` · npm `json-2-csv`: affected `>=3.15.0, <5.5.11`, fixed in `5.5.11` · CVSS 7.0 High · Not analysed yet · Published 28 May 2026 · Tags: Other injection - [Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names](https://agentprime.io/advisories/GHSA-vqc8-7275-q272.md) `GHSA-vqc8-7275-q272`, `CVE-2026-45070`, `PKSA-qgpb-b2wz-rty6`, `PKSA-wtxr-p26d-nn42` · Packagist `symfony/mime` and 1 more: affected `<5.4.52 || >=6.0.0, <6.4.40 || >=7.0.0, <7.4.12 || >=8.0.0, <8.0.12`, fixed in `5.4.52`, `6.4.40`, `7.4.12`, `8.0.12` · CVSS 6.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Other injection - [Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address](https://agentprime.io/advisories/GHSA-qpmx-3rfj-7rhv.md) `GHSA-qpmx-3rfj-7rhv`, `CVE-2026-45067`, `PKSA-2n2k-66v2-bwg3`, `PKSA-z2fd-3m4y-rrss` · Packagist `symfony/mime` and 1 more: affected `<5.4.52 || >=6.0.0, <6.4.40 || >=7.0.0, <7.4.12 || >=8.0.0, <8.0.12`, fixed in `5.4.52`, `6.4.40`, `7.4.12`, `8.0.12` · CVSS 6.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Other injection - [pam_usb: XPath injection via PAM-supplied identifiers in pam_usb configuration queries](https://agentprime.io/advisories/CVE-2026-47273.md) `CVE-2026-47273` · CVE record: mcdope pam_usb · CVSS 6.5 Medium · Not analysed yet · Published 27 May 2026 · Tags: Other injection - [itsourcecode Courier Management System parcel_list.php sql injection](https://agentprime.io/advisories/CVE-2026-9607.md) `CVE-2026-9607` · CVE record: itsourcecode Courier Management System · CVSS 5.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Other injection, SQL injection - [Yamcs Vulnerable to LDAP Injection in LdapAuthModule](https://agentprime.io/advisories/GHSA-cqh3-jg8p-336j.md) `GHSA-cqh3-jg8p-336j`, `CVE-2026-42568` · Maven `org.yamcs:yamcs-core`: affected `<5.12.7`, fixed in `5.12.7` · CVSS 4.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .