# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Spring Framework response splitting in ContentDisposition](https://agentprime.io/advisories/CVE-2026-59314.md) `CVE-2026-59314` · CVE record: Spring Spring Framework · CVSS 3.7 Low · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection - [Server Sent Event stream corruption in Spring MVC functional web framework](https://agentprime.io/advisories/CVE-2026-59313.md) `CVE-2026-59313` · CVE record: Spring Spring Framework · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection - [openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to r...](https://agentprime.io/advisories/GHSA-539p-fxf4-7fv8.md) `GHSA-539p-fxf4-7fv8`, `CVE-2026-81696`, `PYSEC-2026-3775` · PyPI `openssl-encrypt`: affected `<1.4.9`, fixed in `1.4.9` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection - [openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key_id con...](https://agentprime.io/advisories/GHSA-jwfm-99h7-2w5x.md) `GHSA-jwfm-99h7-2w5x`, `CVE-2026-81695`, `PYSEC-2026-3774` · PyPI `openssl-encrypt`: affected `<1.4.9`, fixed in `1.4.9` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection - [openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in the verify-usb comma...](https://agentprime.io/advisories/GHSA-c793-rj9w-r3wg.md) `GHSA-c793-rj9w-r3wg`, `CVE-2026-81694`, `PYSEC-2026-3960` · PyPI `openssl-encrypt`: affected `<1.4.9`, fixed in `1.4.9` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection - [Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing](https://agentprime.io/advisories/CVE-2026-19092.md) `CVE-2026-19092` · CVE record: Unknown Tutor LMS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection - [Formula Injection in dool project](https://agentprime.io/advisories/CVE-2026-56652.md) `CVE-2026-56652` · CVE record: scottchiefbaker dool · CVSS 4.6 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection - [Apache APISIX: ldap-auth plugin cross-subtree identity impersonation](https://agentprime.io/advisories/CVE-2026-75020.md) `CVE-2026-75020` · CVE record: Apache Software Foundation Apache APISIX · CVSS 7.0 High · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection - [Spring Framework Server Sent Event stream corruption while rendering fragments](https://agentprime.io/advisories/GHSA-j9f9-w8pj-32f8.md) `GHSA-j9f9-w8pj-32f8`, `CVE-2026-47890` · Maven `org.springframework:spring-webflux` and 1 more: affected `>=6.2.0, <=6.2.19 || >=7.0.0, <7.0.9`, fixed in `7.0.9` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection - [go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability.](https://agentprime.io/advisories/CVE-2026-75419.md) `CVE-2026-75419` · CVE record · CVSS 8.8 High · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection - [SourceCodester Simple Online Food Ordering System ajax.php login2 sql injection](https://agentprime.io/advisories/CVE-2026-81203.md) `CVE-2026-81203` · CVE record: SourceCodester Simple Online Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Other injection, SQL injection - [Injection in WebPros Plesk](https://agentprime.io/advisories/CVE-2026-65646.md) `CVE-2026-65646` · CVE record: WebPros Plesk · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Other injection - [@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys](https://agentprime.io/advisories/GHSA-8h6h-x5pq-56fq.md) `GHSA-8h6h-x5pq-56fq`, `CVE-2026-54511` · npm `@logtape/syslog`: affected `<1.3.11 || >=2.0.0, <2.0.14 || >=2.1.0, <2.1.5`, fixed in `1.3.11`, `2.0.14`, `2.1.5` · CVSS 8.6 High · Not analysed yet · Published 26 Aug 2026 · Tags: Other injection - [Blind LDAP Injection in Sign-In Endpoint in TÜBİTAK BİLGEM's Liderahenk](https://agentprime.io/advisories/CVE-2026-19271.md) `CVE-2026-19271` · CVE record: TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk · CVSS 7.5 High · Not analysed yet · Published 26 Aug 2026 · Tags: Other injection - [Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String Injection](https://agentprime.io/advisories/CVE-2026-12717.md) `CVE-2026-12717` · CVE record: Google Cloud BigQuery Data Transfer Service · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Other injection - [CRLF injection in Ubiquiti Inc UniFi OS Server and others](https://agentprime.io/advisories/CVE-2026-77550.md) `CVE-2026-77550` · CVE record: Ubiquiti Inc UniFi OS Server and 4 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Other injection - [CRLF injection in Ubiquiti Inc UniFi OS Server and others](https://agentprime.io/advisories/CVE-2026-77549.md) `CVE-2026-77549` · CVE record: Ubiquiti Inc UniFi OS Server and 4 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Other injection - [TOTOLINK N600R cstecgi.cgi getCurrentTime command injection](https://agentprime.io/advisories/CVE-2026-79912.md) `CVE-2026-79912` · CVE record: TOTOLINK N600R · CVSS 6.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Other injection, Command injection - [code-projects Simple Inventory System edit.php sql injection](https://agentprime.io/advisories/CVE-2026-79845.md) `CVE-2026-79845` · CVE record: code-projects Simple Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Other injection, SQL injection - [SililaWijesinghe Food Ordering System search.php sql injection](https://agentprime.io/advisories/CVE-2026-79804.md) `CVE-2026-79804` · CVE record: SililaWijesinghe Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Other injection, SQL injection - [Injection in Google Chrome](https://agentprime.io/advisories/CVE-2026-79234.md) `CVE-2026-79234` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Other injection - [Injection in Google Chrome](https://agentprime.io/advisories/CVE-2026-79087.md) `CVE-2026-79087` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Other injection - [liketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injection](https://agentprime.io/advisories/CVE-2026-78864.md) `CVE-2026-78864` · CVE record: liketrek TREK · CVSS 5.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Other injection, SQL injection - [TYPO3-EXT-SA-2026-025: Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)](https://agentprime.io/advisories/PKSA-xyyb-y2c3-k558.md) `PKSA-xyyb-y2c3-k558`, `CVE-2026-56094` · Packagist `apache-solr-for-typo3/solr`: affected `<11.2.8 || >=11.5.0, <11.6.6 || >=12.0.0, <12.1.4 || >=13.0.0, <13.1.4`, fixed in `11.2.8`, `11.6.6`, `12.1.4`, `13.1.4` · CVSS 6.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Other injection - [TYPO3-EXT-SA-2026-025: Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)](https://agentprime.io/advisories/PKSA-218x-ph2q-d2nf.md) `PKSA-218x-ph2q-d2nf`, `CVE-2026-56096` · Packagist `apache-solr-for-typo3/solr`: affected `<11.2.8 || >=11.5.0, <11.6.6 || >=12.0.0, <12.1.4 || >=13.0.0, <13.1.4`, fixed in `11.2.8`, `11.6.6`, `12.1.4`, `13.1.4` · CVSS 6.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Other injection - [itsourcecode Sales and Inventory System cust_del.php sql injection](https://agentprime.io/advisories/CVE-2026-78656.md) `CVE-2026-78656` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Other injection, SQL injection - [Fdawgs node-poppler Argument Injection index.js pdfUnite argument injection](https://agentprime.io/advisories/CVE-2026-78637.md) `CVE-2026-78637` · CVE record: Fdawgs node-poppler · CVSS 6.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Other injection, Command injection - [netfoil vulnerable to improper handling of untrusted DoH response data](https://agentprime.io/advisories/GHSA-4ph6-mjv7-3fq6.md) `GHSA-4ph6-mjv7-3fq6`, `GO-2026-6277` · Go `github.com/tinfoil-factory/netfoil`: affected `<0.5.0`, fixed in `0.5.0` · CVSS 4.0, no score published · Not analysed yet · Published 24 Aug 2026 · Tags: Other injection - [Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy](https://agentprime.io/advisories/GHSA-vvwm-3j43-7pfm.md) `GHSA-vvwm-3j43-7pfm`, `CVE-2026-63621` · Maven `org.apache.camel:camel-knative`: affected `>=3.15.0, <4.14.9 || >=4.15.0, <4.18.4 || >=4.19.0, <4.22.0`, fixed in `4.14.9`, `4.18.4`, `4.22.0` · CVSS 5.3 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Other injection, CWE-20 - [TIM Flow < 26.0.6 CRLF Injection via rt Parameter](https://agentprime.io/advisories/CVE-2026-39915.md) `CVE-2026-39915` · CVE record: TIM Solutions TIM Flow · CVSS 8.5 High · Not analysed yet · Published 24 Aug 2026 · Tags: Other injection - [SourceCodester Simple Online Food Ordering System ajax.php save_settings sql injection](https://agentprime.io/advisories/CVE-2026-78248.md) `CVE-2026-78248` · CVE record: SourceCodester Simple Online Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Other injection, SQL injection - [SourceCodester Simple Online Food Ordering System ajax.php confirm_order sql injection](https://agentprime.io/advisories/CVE-2026-78247.md) `CVE-2026-78247` · CVE record: SourceCodester Simple Online Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Clinic Management System Admin Login login.php sql injection](https://agentprime.io/advisories/CVE-2026-78246.md) `CVE-2026-78246` · CVE record: itsourcecode Online Clinic Management System · CVSS 6.9 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Real Estate Management System search.php sql injection](https://agentprime.io/advisories/CVE-2026-78244.md) `CVE-2026-78244` · CVE record: itsourcecode Real Estate Management System · CVSS 6.9 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Payroll System admin_class.php login sql injection](https://agentprime.io/advisories/CVE-2026-78201.md) `CVE-2026-78201` · CVE record: itsourcecode Payroll System · CVSS 6.9 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Library Management System editbooks.php sql injection](https://agentprime.io/advisories/CVE-2026-78200.md) `CVE-2026-78200` · CVE record: itsourcecode Library Management System · CVSS 5.3 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Other injection, SQL injection - [SourceCodester Simple Online Food Ordering System view_prod.php sql injection](https://agentprime.io/advisories/CVE-2026-78199.md) `CVE-2026-78199` · CVE record: SourceCodester Simple Online Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Other injection, SQL injection - [SourceCodester Simple Online Food Ordering System ajax.php add_to_cart sql injection](https://agentprime.io/advisories/CVE-2026-78198.md) `CVE-2026-78198` · CVE record: SourceCodester Simple Online Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Other injection, SQL injection - [SourceCodester Simple Online Food Ordering System ajax.php save_user sql injection](https://agentprime.io/advisories/CVE-2026-78197.md) `CVE-2026-78197` · CVE record: SourceCodester Simple Online Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System cust_edit.php sql injection](https://agentprime.io/advisories/CVE-2026-78185.md) `CVE-2026-78185` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Other injection, SQL injection - [Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System plansImmediate PlanController.getImmediatePlans sql injection](https://agentprime.io/advisories/CVE-2026-78182.md) `CVE-2026-78182` · CVE record: Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System · CVSS 6.9 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System processlogin.php sql injection](https://agentprime.io/advisories/CVE-2026-78171.md) `CVE-2026-78171` · CVE record: itsourcecode Sales and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Other injection, SQL injection - [provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injection](https://agentprime.io/advisories/CVE-2026-78166.md) `CVE-2026-78166` · CVE record: provectus kafka-ui · CVSS 5.3 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Other injection, Code injection - [exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values](https://agentprime.io/advisories/CVE-2026-78209.md) `CVE-2026-78209` · CVE record: exceljs exceljs · CVSS 8.4 High · Not analysed yet · Published 24 Aug 2026 · Tags: Other injection - [code-projects Barangay Resident Profiling Management System Resident Search Functionality residents.php sql injection](https://agentprime.io/advisories/CVE-2026-78143.md) `CVE-2026-78143` · CVE record: code-projects Barangay Resident Profiling Management System · CVSS 6.9 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Other injection, SQL injection - [Tenda CH22 exeCommand formexeCommand command injection](https://agentprime.io/advisories/CVE-2026-78141.md) `CVE-2026-78141` · CVE record: Tenda CH22 · CVSS 5.3 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Other injection, Command injection - [Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line](https://agentprime.io/advisories/CVE-2026-75922.md) `CVE-2026-75922` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Other injection, HTTP request smuggling - [itsourcecode Hospital Management System Project in PHP viewservicetype.php sql injection](https://agentprime.io/advisories/CVE-2026-78112.md) `CVE-2026-78112` · CVE record: itsourcecode Hospital Management System Project in PHP · CVSS 5.3 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Other injection, SQL injection - [Tenda CH22 editFileName formeditFileName command injection](https://agentprime.io/advisories/CVE-2026-78063.md) `CVE-2026-78063` · CVE record: Tenda CH22 · CVSS 5.3 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Other injection, Command injection - [sambitraj Student-Management-System Management Mutation sql injection](https://agentprime.io/advisories/CVE-2026-78057.md) `CVE-2026-78057` · CVE record: sambitraj Student-Management-System · CVSS 5.3 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Other injection, SQL injection - [sambitraj Student-Management-System Dashboard sql injection](https://agentprime.io/advisories/CVE-2026-78056.md) `CVE-2026-78056` · CVE record: sambitraj Student-Management-System · CVSS 5.3 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Other injection, SQL injection - [TRENDnet TEW-823DRU CLI Configuration Tool nvram_get command injection](https://agentprime.io/advisories/CVE-2026-77988.md) `CVE-2026-77988` · CVE record: TRENDnet TEW-823DRU · CVSS 5.1 Medium · Not analysed yet · Published 22 Aug 2026 · Tags: Other injection, Command injection - [TRENDnet TEW-821DAP ssi upload.cgi command injection](https://agentprime.io/advisories/CVE-2026-77945.md) `CVE-2026-77945` · CVE record: TRENDnet TEW-821DAP · CVSS 5.3 Medium · Not analysed yet · Published 22 Aug 2026 · Tags: Other injection, Command injection - [ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display Name](https://agentprime.io/advisories/CVE-2026-19848.md) `CVE-2026-19848` · CVE record: Unknown ProfilePress · CVSS 6.5 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Other injection - [Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability](https://agentprime.io/advisories/CVE-2026-59296.md) `CVE-2026-59296` · CVE record: Spring Micrometer · CVSS 5.9 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Other injection - [Comfast CF-N1-S mbox-config system command injection](https://agentprime.io/advisories/CVE-2026-77683.md) `CVE-2026-77683` · CVE record: Comfast CF-N1-S · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2026 · Tags: Other injection, Command injection - [Element and Attribute Names Injected Verbatim into XML Output in xml_builder](https://agentprime.io/advisories/GHSA-r82p-3q2p-728w.md) `GHSA-r82p-3q2p-728w`, `CVE-2026-48590`, `EEF-CVE-2026-48590` · Hex `xml_builder`: affected `>=0.0.1, <2.4.1`, fixed in `2.4.1` · CVSS 2.1 Low · Not analysed yet · Published 21 Aug 2026 · Tags: Other injection - [CDATA Section Breakout via Unsanitised \]\]> in xml_builder](https://agentprime.io/advisories/GHSA-67r9-hmxw-h595.md) `GHSA-67r9-hmxw-h595`, `CVE-2026-47080`, `EEF-CVE-2026-47080` · Hex `xml_builder`: affected `>=0.0.7, <2.4.1`, fixed in `2.4.1` · CVSS 2.1 Low · Not analysed yet · Published 21 Aug 2026 · Tags: Other injection - [SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP submit.php saveUser sql injection](https://agentprime.io/advisories/CVE-2026-77392.md) `CVE-2026-77392` · CVE record: SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP · CVSS 5.3 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Other injection, SQL injection - [HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit](https://agentprime.io/advisories/GHSA-x3gh-xhj4-3vq8.md) `GHSA-x3gh-xhj4-3vq8`, `CVE-2026-75484`, `EEF-CVE-2026-75484` · Hex `bandit`: affected `>=1.4.0, <1.12.5`, fixed in `1.12.5` · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .