# Other injection.

LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [SourceCodester Class and Exam Timetabling System preview.php sql injection](https://agentprime.io/advisories/CVE-2026-13485.md)
  `CVE-2026-13485` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 28 Jun 2026 · Tags: Other injection, SQL injection
- [Statamic Vulnerable to CSV formula injection in form submission exports](https://agentprime.io/advisories/GHSA-h77m-qrj7-jxcw.md)
  `GHSA-h77m-qrj7-jxcw`, `CVE-2026-54243`, `PKSA-q7zp-ytbf-kmf9` · Packagist `statamic/cms`: affected `<5.73.24 || >=6.0.0, <6.20.1`, fixed in `5.73.24`, `6.20.1` · CVSS 6.1 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Other injection
- [Flawfinder output manipulation via untrusted filenames and source text](https://agentprime.io/advisories/GHSA-4c3c-r6p8-c863.md)
  `GHSA-4c3c-r6p8-c863`, `CVE-2026-48813`, `PYSEC-2026-2480` · PyPI `flawfinder`: affected `<2.0.20`, fixed in `2.0.20` · CVSS 8.7 High · Not analysed yet · Published 26 Jun 2026 · Tags: Other injection
- [OpenAM Authentication Bypass via MSISDN LDAP Injection](https://agentprime.io/advisories/GHSA-xq73-fvmr-jvmm.md)
  `GHSA-xq73-fvmr-jvmm`, `CVE-2026-46619` · Maven `org.openidentityplatform.openam:openam-auth-msisdn`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Other injection, CWE-1188
- [Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates](https://agentprime.io/advisories/CVE-2026-57522.md)
  `CVE-2026-57522` · CVE record: bitwarden server · CVSS 2.3 Low · Not analysed yet · Published 25 Jun 2026 · Tags: Other injection
- [Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO](https://agentprime.io/advisories/CVE-2026-45689.md)
  `CVE-2026-45689` · CVE record: RocketChat Rocket.Chat · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2026 · Tags: Other injection
- [Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session Hijack](https://agentprime.io/advisories/CVE-2026-45688.md)
  `CVE-2026-45688` · CVE record: RocketChat Rocket.Chat · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2026 · Tags: Other injection
- [Jenkins Active Directory Plugin has an LDAP injection vulnerability](https://agentprime.io/advisories/GHSA-gx55-p8g7-p3fh.md)
  `GHSA-gx55-p8g7-p3fh`, `CVE-2026-57288` · Maven `org.jenkins-ci.plugins:active-directory`: affected `<2.41.2`, fixed in `2.41.2` · CVSS 3.7 Low · Not analysed yet · Published 24 Jun 2026 · Tags: Other injection
- [Jenkins Script Security Plugin has a script security bypass vulnerability](https://agentprime.io/advisories/GHSA-cfj9-2vgr-hpxp.md)
  `GHSA-cfj9-2vgr-hpxp`, `CVE-2026-57281` · Maven `org.jenkins-ci.plugins:script-security`: affected `<1402.1405.vc96e74964250`, fixed in `1402.1405.vc96e74964250` · CVSS 7.5 High · Not analysed yet · Published 24 Jun 2026 · Tags: Other injection, Code injection, CWE-693
- [Log injection in upKeeper Solutions upKeeper Instant Privilege Access](https://agentprime.io/advisories/CVE-2026-10745.md)
  `CVE-2026-10745` · CVE record: upKeeper Solutions upKeeper Instant Privilege Access · CVSS 7.9 High · Not analysed yet · Published 24 Jun 2026 · Tags: Other injection
- [Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection](https://agentprime.io/advisories/GHSA-pwpj-p52h-q484.md)
  `GHSA-pwpj-p52h-q484`, `CVE-2026-54329`, `PKSA-2tsw-c1yg-xhyc` · Packagist `snipe/snipe-it`: affected `<8.6.2`, fixed in `8.6.2` · CVSS 8.5 High · Not analysed yet · Published 23 Jun 2026 · Tags: Other injection, Broken access control
- [Budibase has nonymous NoSQL operator injection via published-app query templates](https://agentprime.io/advisories/GHSA-8qv3-p479-cj62.md)
  `GHSA-8qv3-p479-cj62`, `CVE-2026-54350` · npm `@budibase/server`: affected `<3.39.12`, fixed in `3.39.12` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jun 2026 · Tags: SQL injection, Other injection
- [Configuration Injection via Carriage Return (\r) in write() method](https://agentprime.io/advisories/CVE-2026-0864.md)
  `CVE-2026-0864` · CVE record: Python Software Foundation CPython · CVSS 4.1 Medium · Not analysed yet · Published 23 Jun 2026 · Tags: Other injection
- [Duplicate Advisory: Hono missing validation of cookie name on write path in setCookie()](https://agentprime.io/advisories/GHSA-55cm-p4ww-685g.md)
  `GHSA-55cm-p4ww-685g` · npm `hono`: affected `<4.12.12`, fixed in `4.12.12` · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 23 Jun 2026 · Tags: Other injection, CWE-20
- [@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields](https://agentprime.io/advisories/GHSA-xqjm-27pc-rvwm.md)
  `GHSA-xqjm-27pc-rvwm`, `CVE-2026-50179` · npm `@actual-app/web`: affected `<26.6.0`, fixed in `26.6.0` · CVSS 4.2 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: Other injection
- [skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery](https://agentprime.io/advisories/GHSA-74p7-6h78-gw8p.md)
  `GHSA-74p7-6h78-gw8p` · crates.io `skillctl`: affected `<0.1.3`, fixed in `0.1.3` · No CVSS score · Not analysed yet · Published 22 Jun 2026 · Tags: Path traversal, Command injection, Other injection, Denial of service
- [@actual-app/cli \`--format csv\` Output Vulnerable to CSV Formula Injection via Custom \`escapeCsv\` Helper](https://agentprime.io/advisories/GHSA-7gh7-258j-4mpq.md)
  `GHSA-7gh7-258j-4mpq`, `CVE-2026-46672` · npm `@actual-app/cli`: affected `<26.6.0`, fixed in `26.6.0` · CVSS 4.6 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: Other injection
- [OpenAM has LDAP Injection via \`\_queryId\` Parameter](https://agentprime.io/advisories/GHSA-2vg8-q4c2-5cw3.md)
  `GHSA-2vg8-q4c2-5cw3`, `CVE-2026-41573` · Maven `org.openidentityplatform.openam:openam-core-rest`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 7.1 High · Not analysed yet · Published 22 Jun 2026 · Tags: Other injection
- [HTML injection in the Canarytoken Google Chat notification](https://agentprime.io/advisories/CVE-2026-12888.md)
  `CVE-2026-12888` · CVE record: Thinkst Applied Research Canarytokens · CVSS 2.0 Low · Not analysed yet · Published 22 Jun 2026 · Tags: Other injection
- [Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections](https://agentprime.io/advisories/CVE-2026-11373.md)
  `CVE-2026-11373` · CVE record: JASEI Net::Statsite::Client · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jun 2026 · Tags: Other injection, CWE-150
- [langflow-ai langflow Bundle URL Loader code injection](https://agentprime.io/advisories/CVE-2026-12822.md)
  `CVE-2026-12822` · CVE record: langflow-ai langflow · CVSS 4.8 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Other injection, Code injection
- [Radware Cyber Controller HTML Report Generation HTML injection](https://agentprime.io/advisories/CVE-2026-12812.md)
  `CVE-2026-12812` · CVE record: Radware Cyber Controller · CVSS 5.1 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Other injection, Cross-site scripting (XSS)
- [Edimax BR-6478AC V2 POST Request mp command injection](https://agentprime.io/advisories/CVE-2026-12810.md)
  `CVE-2026-12810` · CVE record: Edimax BR-6478AC V2 · CVSS 5.3 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Other injection, Command injection
- [Edimax BR-6478AC V2 POST Request wiz_5in1_redirect command injection](https://agentprime.io/advisories/CVE-2026-12809.md)
  `CVE-2026-12809` · CVE record: Edimax BR-6478AC V2 · CVSS 5.3 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Other injection, Command injection
- [Edimax BR-6478AC V2 POST Request stainfo command injection](https://agentprime.io/advisories/CVE-2026-12808.md)
  `CVE-2026-12808` · CVE record: Edimax BR-6478AC V2 · CVSS 5.3 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Other injection, Command injection
- [Edimax BR-6478AC V2 POST Request setWAN command injection](https://agentprime.io/advisories/CVE-2026-12807.md)
  `CVE-2026-12807` · CVE record: Edimax BR-6478AC V2 · CVSS 5.3 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Other injection, Command injection
- [ILIAS Learning Management System Learning Progress Tracking class.ilTrQuery.php executeQueries sql injection](https://agentprime.io/advisories/CVE-2026-12789.md)
  `CVE-2026-12789` · CVE record: ILIAS Learning Management System · CVSS 5.1 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Other injection, SQL injection
- [Montodel House-Rental-Management index.php houses sql injection](https://agentprime.io/advisories/CVE-2026-12776.md)
  `CVE-2026-12776` · CVE record: Montodel House-Rental-Management · CVSS 5.3 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Other injection, SQL injection
- [Montodel House-Rental-Management login.php sql injection](https://agentprime.io/advisories/CVE-2026-12775.md)
  `CVE-2026-12775` · CVE record: Montodel House-Rental-Management · CVSS 6.9 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Other injection, SQL injection
- [OpenBao: LDAPi ldaputil (wrong escape func)](https://agentprime.io/advisories/GHSA-6mwx-4547-5vc9.md)
  `GHSA-6mwx-4547-5vc9`, `BIT-openbao-2026-55770`, `CVE-2026-55770`, `GO-2026-5182` · Go `github.com/openbao/openbao`: affected `<0.0.0-20260617104213-10b7825c714c || >=0.1.0, <=2.5.4`, fixed in `0.0.0-20260617104213-10b7825c714c` · CVSS 6.8 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Other injection
- [containerd CRI — image-config \`LABEL\` flows to restart-monitor \`binary://\` logger: host-root command execution from an image pull](https://agentprime.io/advisories/GHSA-xhf5-7wjv-pqxp.md)
  `GHSA-xhf5-7wjv-pqxp`, `CVE-2026-53488`, `GO-2026-5758` · Go `github.com/containerd/containerd` and 1 more: affected `>=1.7.0, <1.7.33`, fixed in `1.7.33` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Jun 2026 · Tags: Other injection, CWE-20
- [guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization](https://agentprime.io/advisories/GHSA-vm85-hxw5-5432.md)
  `GHSA-vm85-hxw5-5432`, `CVE-2026-55766`, `PKSA-7qs6-zvnz-h66r` · Packagist `guzzlehttp/psr7`: affected `<2.12.1`, fixed in `2.12.1` · CVSS 4.8 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Other injection
- [undici vulnerable to HTTP header injection via Set-Cookie percent-decoding](https://agentprime.io/advisories/GHSA-p88m-4jfj-68fv.md)
  `GHSA-p88m-4jfj-68fv`, `CVE-2026-9679` · npm `undici`: affected `<6.27.0 || >=7.0.0, <7.28.0 || >=8.0.0, <8.5.0`, fixed in `6.27.0`, `7.28.0`, `8.5.0` · CVSS 5.9 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Other injection
- [canto-saas-api: Authenticated API requests can be redirected via unencoded path variables](https://agentprime.io/advisories/GHSA-9qfv-wgh2-m6p8.md)
  `GHSA-9qfv-wgh2-m6p8`, `CVE-2026-55374`, `PKSA-j2jj-8zzq-m6yn` · Packagist `jleehr/canto-saas-api`: affected `<3.0.0`, fixed in `3.0.0` · CVSS 4.8 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Other injection, Server-side request forgery (SSRF)
- [Kirby: Request header injection in \`Http\Remote\`](https://agentprime.io/advisories/GHSA-4v4h-m2qq-ppgw.md)
  `GHSA-4v4h-m2qq-ppgw`, `CVE-2026-50188`, `PKSA-k11s-611y-v46q` · Packagist `getkirby/cms`: affected `<4.9.4 || >=5.0.0-alpha.1, <5.4.4`, fixed in `4.9.4`, `5.4.4` · CVSS 6.9 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: Other injection
- [opentelemetry-collector-contrib sentryexporter: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token](https://agentprime.io/advisories/GHSA-4jvg-4jfx-fmhc.md)
  `GHSA-4jvg-4jfx-fmhc`, `CVE-2026-47256`, `GO-2026-5126` · Go `github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter`: affected `<0.154.0`, fixed in `0.154.0` · CVSS 5.3 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: Path traversal, Other injection
- [Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode](https://agentprime.io/advisories/GHSA-4jgr-pg2m-m988.md)
  `GHSA-4jgr-pg2m-m988`, `CVE-2026-57209`, `GO-2026-5125` · Go `github.com/dadrus/heimdall`: affected `<0.17.17`, fixed in `0.17.17` · CVSS 7.0 High · Not analysed yet · Published 18 Jun 2026 · Tags: Other injection, CWE-20
- [http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in \`fixRequestBody\`](https://agentprime.io/advisories/GHSA-gcq2-9pq2-cxqm.md)
  `GHSA-gcq2-9pq2-cxqm`, `CVE-2026-55603` · npm `http-proxy-middleware`: affected `>=3.0.4, <3.0.7 || >=4.0.0, <4.1.1`, fixed in `3.0.7`, `4.1.1` · CVSS 7.5 High · Not analysed yet · Published 18 Jun 2026 · Tags: Other injection
- [NGINX Gateway Fabric vulnerability](https://agentprime.io/advisories/CVE-2026-50107.md)
  `CVE-2026-50107` · CVE record: F5 NGINX Gateway Fabric · CVSS 8.6 High · Not analysed yet · Published 17 Jun 2026 · Tags: Other injection
- [Apache Shiro: LDAP DN Injection in DefaultLdapRealm](https://agentprime.io/advisories/GHSA-x96m-rh44-vgv8.md)
  `GHSA-x96m-rh44-vgv8`, `CVE-2026-49268` · Maven `org.apache.shiro:shiro-core`: affected `<2.2.1 || >=3.0.0-alpha-0, <3.0.0-alpha-2`, fixed in `2.2.1`, `3.0.0-alpha-2` · CVSS 8.8 High · Not analysed yet · Published 17 Jun 2026 · Tags: Other injection
- [Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode](https://agentprime.io/advisories/GHSA-p5cp-r7rg-qpxc.md)
  `GHSA-p5cp-r7rg-qpxc`, `CVE-2026-54019`, `PYSEC-2026-2750` · PyPI `open-webui`: affected `<0.9.6`, fixed in `0.9.6` · CVSS 6.5 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: Broken access control, Other injection
- [Cisco Crosswork Network Controller Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-20220.md)
  `CVE-2026-20220` · CVE record: Cisco Cisco Crosswork Network Change Automation · CVSS 6.3 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: Other injection
- [Laravel Framework: CRLF injection in default email rule](https://agentprime.io/advisories/GHSA-5vg9-5847-vvmq.md)
  `GHSA-5vg9-5847-vvmq`, `CVE-2026-48019`, `PKSA-3r5d-mb8f-1qw9`, `PKSA-mdq4-51ck-6kdq`, `PKSA-zwc5-qtrz-zm1n` · Packagist `laravel/framework`: affected `<12.60.0 || >=13.0.0, <13.10.0`, fixed in `12.60.0`, `13.10.0` · CVSS 8.9 High · Not analysed yet · Published 17 Jun 2026 · Tags: Other injection
- [yt-dlp: Arbitrary code execution via manifest downloads with aria2c](https://agentprime.io/advisories/GHSA-vx4q-3cr2-7cg2.md)
  `GHSA-vx4q-3cr2-7cg2`, `CVE-2026-50574`, `PYSEC-2026-3433` · PyPI `yt-dlp`: affected `<2026.6.9`, fixed in `2026.6.9` · CVSS 8.3 High · Not analysed yet · Published 16 Jun 2026 · Tags: Other injection
- [Crawl4AI: Arbitrary file write (symlink/TOCTOU) plus log and webhook-header injection in Docker server](https://agentprime.io/advisories/GHSA-7cx2-g3h9-382p.md)
  `GHSA-7cx2-g3h9-382p`, `CVE-2026-56258`, `PYSEC-2026-228` · PyPI `crawl4ai`: affected `<0.8.8`, fixed in `0.8.8` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Path traversal, Other injection
- [Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores](https://agentprime.io/advisories/GHSA-cmwh-w62w-r2mf.md)
  `GHSA-cmwh-w62w-r2mf`, `CVE-2026-47835` · Maven `org.springframework.ai:spring-ai-elasticsearch-store` and 2 more: affected `>=1.0.0, <1.0.9 || >=1.1.0, <1.1.8`, fixed in `1.0.9`, `1.1.8` · CVSS 8.6 High · Not analysed yet · Published 15 Jun 2026 · Tags: Other injection
- [aiohttp: CRLF injection in multipart headers](https://agentprime.io/advisories/GHSA-m6qw-4cw2-hm4m.md)
  `GHSA-m6qw-4cw2-hm4m`, `CVE-2026-50269`, `PYSEC-2026-2106` · PyPI `aiohttp`: affected `<3.14.0`, fixed in `3.14.0` · CVSS 2.7 Low · Not analysed yet · Published 15 Jun 2026 · Tags: Other injection
- [Nodemailer: CRLF injection in Nodemailer List-\* header comments allows arbitrary message header injection](https://agentprime.io/advisories/GHSA-268h-hp4c-crq3.md)
  `GHSA-268h-hp4c-crq3`, `CVE-2026-82661` · npm `nodemailer`: affected `<8.0.9`, fixed in `8.0.9` · CVSS 5.3 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: Other injection
- [form-data: CRLF injection in form-data via unescaped multipart field names and filenames](https://agentprime.io/advisories/GHSA-hmw2-7cc7-3qxx.md)
  `GHSA-hmw2-7cc7-3qxx`, `CVE-2026-12143` · npm `form-data`: affected `<2.5.6 || >=3.0.0, <3.0.5 || >=4.0.0, <4.0.6`, fixed in `2.5.6`, `3.0.5`, `4.0.6` · CVSS 8.7 High · Not analysed yet · Published 15 Jun 2026 · Tags: Other injection
- [Code Injection in Mia Technologies' Pizzy Library](https://agentprime.io/advisories/CVE-2026-5242.md)
  `CVE-2026-5242` · CVE record: MIA Technology Inc. Pizzy Library · CVSS 8.8 High · Not analysed yet · Published 15 Jun 2026 · Tags: Other injection
- [Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection](https://agentprime.io/advisories/CVE-2026-12223.md)
  `CVE-2026-12223` · CVE record: Yealink SIP-T46U · CVSS 5.1 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: Other injection, Command injection
- [Yealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injection](https://agentprime.io/advisories/CVE-2026-12219.md)
  `CVE-2026-12219` · CVE record: Yealink SIP-T46U · CVSS 5.3 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: Other injection, Command injection
- [Grit42 Grit data_table_entity.rb DataTableEntity sql injection](https://agentprime.io/advisories/CVE-2026-12206.md)
  `CVE-2026-12206` · CVE record: Grit42 Grit · CVSS 5.3 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: Other injection, SQL injection
- [Ruijie EG105G-P JSON-RPC Diagnose Endpoint diagnose nslookup command injection](https://agentprime.io/advisories/CVE-2026-12197.md)
  `CVE-2026-12197` · CVE record: Ruijie EG105G-P · CVSS 8.6 High · Not analysed yet · Published 14 Jun 2026 · Tags: Other injection, Command injection
- [Grit42 Grit GritEntityController grit_entity_controller.rb sql injection](https://agentprime.io/advisories/CVE-2026-12188.md)
  `CVE-2026-12188` · CVE record: Grit42 Grit · CVSS 5.3 Medium · Not analysed yet · Published 14 Jun 2026 · Tags: Other injection, SQL injection
- [GL.iNet GL-MT3000 Online Firmware Upgrade one_click_upgrade command injection](https://agentprime.io/advisories/CVE-2026-12187.md)
  `CVE-2026-12187` · CVE record: GL.iNet GL-MT3000 · CVSS 8.7 High · Not analysed yet · Published 14 Jun 2026 · Tags: Other injection, Command injection
- [GL.iNet GL-MT3000 Tor Proxy Service Configuration tor replace_country command injection](https://agentprime.io/advisories/CVE-2026-12186.md)
  `CVE-2026-12186` · CVE record: GL.iNet GL-MT3000 · CVSS 8.7 High · Not analysed yet · Published 14 Jun 2026 · Tags: Other injection, Command injection
- [CodeAstro Student Attendance Management System createStudents.php sql injection](https://agentprime.io/advisories/CVE-2026-12175.md)
  `CVE-2026-12175` · CVE record: CodeAstro Student Attendance Management System · CVSS 5.1 Medium · Not analysed yet · Published 13 Jun 2026 · Tags: Other injection, SQL injection
- [Abrt: unsanitized systemd journal content written to dump directory files enables content injection](https://agentprime.io/advisories/CVE-2026-54231.md)
  `CVE-2026-54231` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Jun 2026 · Tags: Other injection
- [CodeAstro Human Resource Management System Payroll Invoice Payroll.php sql injection](https://agentprime.io/advisories/CVE-2026-12131.md)
  `CVE-2026-12131` · CVE record: CodeAstro Human Resource Management System · CVSS 5.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Other injection, SQL injection

Newest: <https://agentprime.io/advisories/tag/injection.md>
Older: <https://agentprime.io/advisories/tag/injection.md?cursor=WyIyMDI2LTA2LTEyVDIxOjE1OjA4LjU0NDAwMFoiLCJDVkUtMjAyNi0xMjEzMSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=injection&cursor=WyIyMDI2LTA2LTI4VDA5OjQ1OjA5LjA5NzAwMFoiLCJDVkUtMjAyNi0xMzQ4NiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/injection/?cursor=WyIyMDI2LTA2LTI4VDA5OjQ1OjA5LjA5NzAwMFoiLCJDVkUtMjAyNi0xMzQ4NiJd>. Everything for agents: <https://agentprime.io/llms.txt>.