# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [SourceCodester Class and Exam Timetabling System edit_schoolyr.php sql injection](https://agentprime.io/advisories/CVE-2026-16228.md) `CVE-2026-16228` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 19 Jul 2026 · Tags: Other injection, SQL injection - [SourceCodester Class and Exam Timetabling System edit_subject.php sql injection](https://agentprime.io/advisories/CVE-2026-16227.md) `CVE-2026-16227` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 19 Jul 2026 · Tags: Other injection, SQL injection - [zevorn rt-claw Telegram-to-AI Tool Execution Flow script.c tool_run_script_execute code injection](https://agentprime.io/advisories/CVE-2026-16204.md) `CVE-2026-16204` · CVE record: zevorn rt-claw · CVSS 5.3 Medium · Not analysed yet · Published 19 Jul 2026 · Tags: Other injection, Code injection - [SourceCodester Class and Exam Timetabling System edit_room1.php sql injection](https://agentprime.io/advisories/CVE-2026-16154.md) `CVE-2026-16154` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 18 Jul 2026 · Tags: Other injection, SQL injection - [SourceCodester Class and Exam Timetabling System edit_rooma.php sql injection](https://agentprime.io/advisories/CVE-2026-16152.md) `CVE-2026-16152` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 18 Jul 2026 · Tags: Other injection, SQL injection - [LiuMengxuan04 MiniCode mcp.ts child_process.spawn command injection](https://agentprime.io/advisories/CVE-2026-16133.md) `CVE-2026-16133` · CVE record: LiuMengxuan04 MiniCode · CVSS 2.3 Low · Not analysed yet · Published 18 Jul 2026 · Tags: Other injection, Command injection - [itsourcecode Hospital Management System prescriptionrecord.php sql injection](https://agentprime.io/advisories/CVE-2026-16131.md) `CVE-2026-16131` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 18 Jul 2026 · Tags: Other injection, SQL injection - [oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code](https://agentprime.io/advisories/GHSA-rjwr-m7qx-3fjr.md) `GHSA-rjwr-m7qx-3fjr`, `GO-2026-6016` · Go `github.com/oapi-codegen/oapi-codegen/v2`: affected `<2.7.1`, fixed in `2.7.1` · CVSS 0.0 None · Not analysed yet · Published 17 Jul 2026 · Tags: Other injection - [code-projects Hospital Bed Management System Login Form sql injection](https://agentprime.io/advisories/CVE-2026-16014.md) `CVE-2026-16014` · CVE record: code-projects Hospital Bed Management System · CVSS 6.9 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Other injection, SQL injection - [itsourcecode Hospital Management System prescriptionorderdetail.php sql injection](https://agentprime.io/advisories/CVE-2026-16009.md) `CVE-2026-16009` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Other injection, SQL injection - [AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentEvent/list endpoint.](https://agentprime.io/advisories/CVE-2025-60357.md) `CVE-2025-60357` · CVE record · CVSS 8.1 High · Not analysed yet · Published 17 Jul 2026 · Tags: Other injection - [ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js](https://agentprime.io/advisories/GHSA-vwjc-v7x7-cm6g.md) `GHSA-vwjc-v7x7-cm6g`, `CVE-2026-67341` · Maven `com.arcadedb:arcadedb-engine`: affected `<26.7.2`, fixed in `26.7.2` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jul 2026 · Tags: Other injection, Broken access control - [bunkerweb: Improper Input Validation and Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in BunkerWeb](https://agentprime.io/advisories/CVE-2026-54728.md) `CVE-2026-54728` · CVE record: bunkerity bunkerweb · CVSS 6.1 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: Other injection, CWE-20 - [H3C SecPath F1000-C8300 g=log_fw_nbc_mail_jsondata sql injection](https://agentprime.io/advisories/CVE-2026-15907.md) `CVE-2026-15907` · CVE record: H3C SecPath F1000-C8300 · CVSS 6.9 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Other injection, SQL injection - [OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UI](https://agentprime.io/advisories/CVE-2026-62948.md) `CVE-2026-62948` · CVE record: openwrt openwrt · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jul 2026 · Tags: Cross-site scripting (XSS), Other injection, CWE-150 - [TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution](https://agentprime.io/advisories/GHSA-9hc2-hjx8-q6pv.md) `GHSA-9hc2-hjx8-q6pv`, `CVE-2026-14722` · npm `tidgi`: affected `<=0.13.0`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Other injection, Code injection - [TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services](https://agentprime.io/advisories/GHSA-pqg7-v6wh-3pfp.md) `GHSA-pqg7-v6wh-3pfp`, `GO-2026-5982` · Go `github.com/almeidapaulopt/tsdproxy`: affected `*`, no fixed version yet · CVSS 8.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Other injection - [FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export](https://agentprime.io/advisories/GHSA-2p5x-4jr6-x5jg.md) `GHSA-2p5x-4jr6-x5jg`, `CVE-2026-45263`, `PKSA-9nsq-164p-6ppm` · Packagist `facturascripts/facturascripts`: affected `<2026.2`, fixed in `2026.2` · CVSS 8.0 High · Not analysed yet · Published 14 Jul 2026 · Tags: Other injection - [Privilege Escalation via Improper Input Sanitization in TP-Link Archer VX1800v](https://agentprime.io/advisories/CVE-2026-15429.md) `CVE-2026-15429` · CVE record: TP-Link Systems Inc. Archer VX1800v v1 · CVSS 5.1 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Other injection - [SourceCodester Simple and Nice Shopping Cart Script userproductdeletequery.php sql injection](https://agentprime.io/advisories/CVE-2026-15703.md) `CVE-2026-15703` · CVE record: SourceCodester Simple and Nice Shopping Cart Script · CVSS 6.9 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Other injection, SQL injection - [HTTP response splitting in Fortinet FortiPAM and others](https://agentprime.io/advisories/CVE-2025-62826.md) `CVE-2025-62826` · CVE record: Fortinet FortiPAM and 2 more · CVSS 3.1 Low · Not analysed yet · Published 14 Jul 2026 · Tags: Other injection - [HTTP response splitting in Fortinet FortiOS and others](https://agentprime.io/advisories/CVE-2025-62675.md) `CVE-2025-62675` · CVE record: Fortinet FortiOS and 2 more · CVSS 3.4 Low · Not analysed yet · Published 14 Jul 2026 · Tags: Other injection - [code-projects Online Job Portal DeleteUser.php sql injection](https://agentprime.io/advisories/CVE-2026-15676.md) `CVE-2026-15676` · CVE record: code-projects Online Job Portal · CVSS 6.9 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Other injection, SQL injection - [code-projects Online Job Portal EditUser.php sql injection](https://agentprime.io/advisories/CVE-2026-15675.md) `CVE-2026-15675` · CVE record: code-projects Online Job Portal · CVSS 6.9 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Other injection, SQL injection - [itsourcecode Electronic Judging System add_judges.php sql injection](https://agentprime.io/advisories/CVE-2026-15672.md) `CVE-2026-15672` · CVE record: itsourcecode Electronic Judging System · CVSS 5.3 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Other injection, SQL injection - [SourceCodester Class and Exam Timetabling System edit_exam2.php sql injection](https://agentprime.io/advisories/CVE-2026-15597.md) `CVE-2026-15597` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Other injection, SQL injection - [CodeAstro Simple Online Leave Management System POST accept.php sql injection](https://agentprime.io/advisories/CVE-2026-15559.md) `CVE-2026-15559` · CVE record: CodeAstro Simple Online Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Other injection, SQL injection - [CodeAstro Simple Online Leave Management System deletemp.php sql injection](https://agentprime.io/advisories/CVE-2026-15558.md) `CVE-2026-15558` · CVE record: CodeAstro Simple Online Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Other injection, SQL injection - [Incorrect neutralisation in the PrestaShop firmware](https://agentprime.io/advisories/CVE-2026-14846.md) `CVE-2026-14846` · CVE record: PrestaShop The firmware · CVSS 4.5 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Other injection - [SourceCodester Online Book Store System login.php sql injection](https://agentprime.io/advisories/CVE-2026-15537.md) `CVE-2026-15537` · CVE record: SourceCodester Online Book Store System · CVSS 6.9 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Other injection, SQL injection - [itsourcecode Hospital Management System patviewprescription.php sql injection](https://agentprime.io/advisories/CVE-2026-15536.md) `CVE-2026-15536` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Other injection, SQL injection - [DedeCMS Column Management search.php code injection](https://agentprime.io/advisories/CVE-2026-15533.md) `CVE-2026-15533` · CVE record: DedeCMS · CVSS 5.1 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Other injection, Code injection - [CodeAstro Simple Online Leave Management System dashboard.php sql injection](https://agentprime.io/advisories/CVE-2026-15523.md) `CVE-2026-15523` · CVE record: CodeAstro Simple Online Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Other injection, SQL injection - [Jinher OA PlanGiveOut.aspx sql injection](https://agentprime.io/advisories/CVE-2026-15517.md) `CVE-2026-15517` · CVE record: Jinher OA · CVSS 6.9 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Other injection, SQL injection - [Metasoft 美特软件 MetaCRM PHPRPC Remote Call rpc.jsp RPCService.query sql injection](https://agentprime.io/advisories/CVE-2026-15514.md) `CVE-2026-15514` · CVE record: Metasoft 美特软件 MetaCRM · CVSS 6.9 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Other injection, SQL injection - [pig-mesh Pig pig-codegen GeneratorServiceImpl.java code injection](https://agentprime.io/advisories/CVE-2026-15512.md) `CVE-2026-15512` · CVE record: pig-mesh Pig · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Other injection, Code injection - [AojiaoZero Antaris PayPal IPN Payment ipn.php \_rewardPurchase sql injection](https://agentprime.io/advisories/CVE-2026-15502.md) `CVE-2026-15502` · CVE record: AojiaoZero Antaris · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Other injection, SQL injection - [sergomanov SmartHomeAdatum Login users.php sql injection](https://agentprime.io/advisories/CVE-2026-15498.md) `CVE-2026-15498` · CVE record: sergomanov SmartHomeAdatum · CVSS 6.9 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Other injection, SQL injection - [SonicCloudOrg sonic-agent JWT Authentication Filter ExchangeController.java code injection](https://agentprime.io/advisories/CVE-2026-15497.md) `CVE-2026-15497` · CVE record: SonicCloudOrg sonic-agent · CVSS 6.9 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Other injection, Code injection - [AMTT Hotel Broadband Operation System switch_status.php sql injection](https://agentprime.io/advisories/CVE-2026-15494.md) `CVE-2026-15494` · CVE record: AMTT Hotel Broadband Operation System · CVSS 5.1 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Other injection, SQL injection - [RafyMrX TOKO-ONLINE-ROTI add.php sql injection](https://agentprime.io/advisories/CVE-2026-15490.md) `CVE-2026-15490` · CVE record: RafyMrX TOKO-ONLINE-ROTI · CVSS 6.9 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Other injection, SQL injection - [RafyMrX TOKO-ONLINE-ROTI login.php sql injection](https://agentprime.io/advisories/CVE-2026-15489.md) `CVE-2026-15489` · CVE record: RafyMrX TOKO-ONLINE-ROTI · CVSS 6.9 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Other injection, SQL injection - [Aster Telecom Azcall HTTP sis.php sql injection](https://agentprime.io/advisories/CVE-2026-15482.md) `CVE-2026-15482` · CVE record: Aster Telecom Azcall · CVSS 6.9 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Other injection, SQL injection - [Trendnet TEW-635BRM IPoA WAN Connection Setup rc ipoa_test command injection](https://agentprime.io/advisories/CVE-2026-15481.md) `CVE-2026-15481` · CVE record: Trendnet TEW-635BRM · CVSS 8.7 High · Not analysed yet · Published 12 Jul 2026 · Tags: Other injection, Command injection - [IceHRM UserReport Endpoint EmployeeAttendanceReport.php sql injection](https://agentprime.io/advisories/CVE-2026-15478.md) `CVE-2026-15478` · CVE record: IceHRM · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Other injection, SQL injection - [Bahmni bahmnicore Search Endpoint sql additionalParams sql injection](https://agentprime.io/advisories/CVE-2026-15477.md) `CVE-2026-15477` · CVE record: Bahmni bahmnicore · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Other injection, SQL injection - [Secure Headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input](https://agentprime.io/advisories/GHSA-rqq5-2gf9-4w4q.md) `GHSA-rqq5-2gf9-4w4q`, `CVE-2026-54163` · RubyGems `secure_headers`: affected `<7.3.0`, fixed in `7.3.0` · CVSS 4.7 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Cross-site scripting (XSS), Other injection - [prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE](https://agentprime.io/advisories/GHSA-m5f5-28qr-9g9r.md) `GHSA-m5f5-28qr-9g9r`, `CVE-2026-54159`, `PKSA-36b6-kgzr-fpm3` · Packagist `prestashop/ps_facetedsearch`: affected `>=3.0.0, <4.0.4`, fixed in `4.0.4` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jul 2026 · Tags: Other injection - [Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providers](https://agentprime.io/advisories/CVE-2026-55789.md) `CVE-2026-55789` · CVE record: logto-io logto · CVSS 8.5 High · Not analysed yet · Published 10 Jul 2026 · Tags: Other injection, CWE-1395 - [grav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String Construction](https://agentprime.io/advisories/CVE-2026-58493.md) `CVE-2026-58493` · CVE record: getgrav grav · CVSS 5.1 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Other injection - [morgan vulnerable to Log Forging via unneutralized control characters in :remote-user](https://agentprime.io/advisories/GHSA-4vj7-5mj6-jm8m.md) `GHSA-4vj7-5mj6-jm8m`, `CVE-2026-5078` · npm `morgan`: affected `>=1.2.0, <1.11.0`, fixed in `1.11.0` · CVSS 5.3 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Other injection - [PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN)](https://agentprime.io/advisories/CVE-2026-0284.md) `CVE-2026-0284` · CVE record: Palo Alto Networks Cloud NGFW and 2 more · CVSS 4.7 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Other injection - [SourceCodester Simple and Nice Shopping Cart Script login.php sql injection](https://agentprime.io/advisories/CVE-2026-15190.md) `CVE-2026-15190` · CVE record: SourceCodester Simple and Nice Shopping Cart Script · CVSS 6.9 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Other injection, SQL injection - [LDAP Injection in PEAKUP's PassGate](https://agentprime.io/advisories/CVE-2026-4256.md) `CVE-2026-4256` · CVE record: PEAKUP Technology Inc. PassGate · CVSS 8.2 High · Not analysed yet · Published 9 Jul 2026 · Tags: Other injection - [code-projects Interview Management System View.php sql injection](https://agentprime.io/advisories/CVE-2026-15137.md) `CVE-2026-15137` · CVE record: code-projects Interview Management System · CVSS 6.9 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Other injection, SQL injection - [code-projects Online Food Order System edit_food_items.php sql injection](https://agentprime.io/advisories/CVE-2026-15135.md) `CVE-2026-15135` · CVE record: code-projects Online Food Order System · CVSS 6.9 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Other injection, SQL injection - [CodeAstro Simple Online Leave Management System index.php sql injection](https://agentprime.io/advisories/CVE-2026-15134.md) `CVE-2026-15134` · CVE record: CodeAstro Simple Online Leave Management System · CVSS 6.9 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Other injection, SQL injection - [NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection](https://agentprime.io/advisories/CVE-2026-58213.md) `CVE-2026-58213` · CVE record: nats-io nats-server · CVSS 7.1 High · Not analysed yet · Published 8 Jul 2026 · Tags: Other injection - [Institution scope bypass vulnerability in custom reports](https://agentprime.io/advisories/CVE-2026-8649.md) `CVE-2026-8649` · CVE record: Progress MOVEit Transfer · CVSS 6.4 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Other injection - [A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performi...](https://agentprime.io/advisories/PYSEC-2026-2089.md) `PYSEC-2026-2089`, `CVE-2026-15035` · PyPI `bentoml`: affected `<=0.6.30`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Other injection, Command injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .