# Other injection.

LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings](https://agentprime.io/advisories/GHSA-h58c-xccx-75m3.md)
  `GHSA-h58c-xccx-75m3`, `CVE-2026-111932`, `GO-2026-6267` · Go `github.com/coder/coder/v2`: affected `<2.29.17 || >=2.30.0, <2.32.7 || >=2.33.0, <2.33.8 || >=2.34.0, <2.34.2`, fixed in `2.29.17`, `2.32.7`, `2.33.8`, `2.34.2` · CVSS 4.8 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection, Cross-site scripting (XSS)
- [LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure](https://agentprime.io/advisories/GHSA-533j-2v4q-mw5h.md)
  `GHSA-533j-2v4q-mw5h`, `CVE-2026-55253`, `PYSEC-2026-3859`, `PYSEC-2026-3860` · PyPI `langgraph-checkpoint-mongodb` and 1 more: affected `<0.3.0`, fixed in `0.3.0` · CVSS 7.7 High · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection
- [Tenda CH22 formcreateFileName command injection](https://agentprime.io/advisories/CVE-2026-77031.md)
  `CVE-2026-77031` · CVE record: Tenda CH22 · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection, Command injection
- [itsourcecode Hospital Management System viewappointmentpending.php sql injection](https://agentprime.io/advisories/CVE-2026-77025.md)
  `CVE-2026-77025` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection, SQL injection
- [CodeAstro Apartment Visitor Management System password-recovery.php sql injection](https://agentprime.io/advisories/CVE-2026-77020.md)
  `CVE-2026-77020` · CVE record: CodeAstro Apartment Visitor Management System · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection, SQL injection
- [CodeAstro Apartment Visitor Management System forgotpw.php sql injection](https://agentprime.io/advisories/CVE-2026-77019.md)
  `CVE-2026-77019` · CVE record: CodeAstro Apartment Visitor Management System · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection, SQL injection
- [Comfast CF-N1-S mbox-config sprintf command injection](https://agentprime.io/advisories/CVE-2026-77004.md)
  `CVE-2026-77004` · CVE record: Comfast CF-N1-S · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection, Command injection
- [SourceCodester Simple Online Food Ordering System ajax.php delete_category sql injection](https://agentprime.io/advisories/CVE-2026-76998.md)
  `CVE-2026-76998` · CVE record: SourceCodester Simple Online Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection, SQL injection
- [SourceCodester Simple Online Food Ordering System ajax.php save_category sql injection](https://agentprime.io/advisories/CVE-2026-76997.md)
  `CVE-2026-76997` · CVE record: SourceCodester Simple Online Food Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection, SQL injection
- [SourceCodester Simple Online Food Ordering System view_order.php sql injection](https://agentprime.io/advisories/CVE-2026-76996.md)
  `CVE-2026-76996` · CVE record: SourceCodester Simple Online Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection, SQL injection
- [GreyDGL PentestGPT Web-Page Crawling injection](https://agentprime.io/advisories/CVE-2026-76993.md)
  `CVE-2026-76993` · CVE record: GreyDGL PentestGPT · CVSS 2.3 Low · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection, CWE-707
- [itsourcecode Hospital Management System viewappointmentapproved.php sql injection](https://agentprime.io/advisories/CVE-2026-76991.md)
  `CVE-2026-76991` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection, SQL injection
- [code-projects Simple Inventory System delete.php sql injection](https://agentprime.io/advisories/CVE-2026-76990.md)
  `CVE-2026-76990` · CVE record: code-projects Simple Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection, SQL injection
- [n8n before 1.123.69 NoSQL Injection via MongoDB Node](https://agentprime.io/advisories/CVE-2026-77070.md)
  `CVE-2026-77070` · CVE record: n8n-io n8n · CVSS 7.1 High · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection
- [amirsanni Mini-Inventory-and-Sales-Management-System Transaction.php getAll sql injection](https://agentprime.io/advisories/CVE-2026-76785.md)
  `CVE-2026-76785` · CVE record: amirsanni Mini-Inventory-and-Sales-Management-System · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection, SQL injection
- [DeDeCMS advancedsearch.php sql injection](https://agentprime.io/advisories/CVE-2026-76783.md)
  `CVE-2026-76783` · CVE record: DeDeCMS · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection, SQL injection
- [code-projects Employee Management System Admin Login Endpoint aprocess.php sql injection](https://agentprime.io/advisories/CVE-2026-76764.md)
  `CVE-2026-76764` · CVE record: code-projects Employee Management System · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection, SQL injection
- [code-projects Assessment Management welcome.php sql injection](https://agentprime.io/advisories/CVE-2026-76762.md)
  `CVE-2026-76762` · CVE record: code-projects Assessment Management · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, SQL injection
- [chenhg5 cc-connect webhook.go authenticate code injection](https://agentprime.io/advisories/CVE-2026-76760.md)
  `CVE-2026-76760` · CVE record: chenhg5 cc-connect · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, Code injection
- [TRENDnet TEW-755AP ssi email.cgi log_email_server command injection](https://agentprime.io/advisories/CVE-2026-76591.md)
  `CVE-2026-76591` · CVE record: TRENDnet TEW-755AP · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, Command injection
- [Filter Injection through Action Parameters in AD LDAP app for Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76373.md)
  `CVE-2026-76373` · CVE record: Splunk AD LDAP app for Splunk SOAR · CVSS 5.4 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection
- [Structured Query Language (SQL) Injection through Custom Lists in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76365.md)
  `CVE-2026-76365` · CVE record: Splunk Splunk SOAR · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection
- [Structured Query Language Injection through the REST API in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76363.md)
  `CVE-2026-76363` · CVE record: Splunk Splunk SOAR · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection
- [SPL Injection through Splunk Web Form Tokens in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76349.md)
  `CVE-2026-76349` · CVE record: Splunk Splunk Enterprise · CVSS 6.4 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection
- [SPL Injection through the REST API in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76331.md)
  `CVE-2026-76331` · CVE record: Splunk Splunk Enterprise · CVSS 8.1 High · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection
- [SPL Injection through Monitoring Console Dashboard Inputs in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76329.md)
  `CVE-2026-76329` · CVE record: Splunk Splunk Enterprise · CVSS 6.4 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection
- [SPL Injection through Splunk Web in Splunk Secure Gateway](https://agentprime.io/advisories/CVE-2026-76327.md)
  `CVE-2026-76327` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.4 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection
- [SPL Injection through Cross-Site Request Forgery (CSRF) in the Event Type Builder in Splunk Web for Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76320.md)
  `CVE-2026-76320` · CVE record: Splunk Splunk Enterprise · CVSS 5.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection
- [Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76316.md)
  `CVE-2026-76316` · CVE record: Splunk Splunk Enterprise · CVSS 8.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection
- [SPL Command Safeguards Bypass through Splunk Web in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76254.md)
  `CVE-2026-76254` · CVE record: Splunk Splunk Enterprise · CVSS 7.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection
- [TRENDnet TV-IP751WIC alphapd set_time.cgi command injection](https://agentprime.io/advisories/CVE-2026-76583.md)
  `CVE-2026-76583` · CVE record: TRENDnet TV-IP751WIC · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, Command injection
- [TRENDnet TEW-821DAP ssi ping.cgi system command injection](https://agentprime.io/advisories/CVE-2026-76582.md)
  `CVE-2026-76582` · CVE record: TRENDnet TEW-821DAP · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, Command injection
- [code-projects Hospital Information System User Login UsersController.php login sql injection](https://agentprime.io/advisories/CVE-2026-76574.md)
  `CVE-2026-76574` · CVE record: code-projects Hospital Information System · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, SQL injection
- [GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)](https://agentprime.io/advisories/GHSA-p77j-g7h5-r2vw.md)
  `GHSA-p77j-g7h5-r2vw` · PyPI `geolens`: affected `<1.2.4`, fixed in `1.2.4` · No CVSS score · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, Information disclosure, Broken access control, Denial of service
- [Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username](https://agentprime.io/advisories/CVE-2026-44256.md)
  `CVE-2026-44256` · CVE record: wazuh wazuh · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection
- [Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Neutralization of Special Elements Vulnerabilities](https://agentprime.io/advisories/CVE-2026-20231.md)
  `CVE-2026-20231` · CVE record: Cisco Cisco Secure Workload · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection
- [SourceCodester Simple Online Food Ordering System ajax.php delete_menu sql injection](https://agentprime.io/advisories/CVE-2026-76050.md)
  `CVE-2026-76050` · CVE record: SourceCodester Simple Online Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, SQL injection
- [SourceCodester Simple Online Food Ordering System ajax.php save_menu sql injection](https://agentprime.io/advisories/CVE-2026-76049.md)
  `CVE-2026-76049` · CVE record: SourceCodester Simple Online Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, SQL injection
- [SourceCodester Simple Online Food Ordering System ajax.php login sql injection](https://agentprime.io/advisories/CVE-2026-76048.md)
  `CVE-2026-76048` · CVE record: SourceCodester Simple Online Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, SQL injection
- [code-projects Online Job Portal System Password Recovery ForPass.php sql injection](https://agentprime.io/advisories/CVE-2026-75986.md)
  `CVE-2026-75986` · CVE record: code-projects Online Job Portal System · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, SQL injection
- [TRENDnet Router ping.cgi command injection](https://agentprime.io/advisories/CVE-2026-75985.md)
  `CVE-2026-75985` · CVE record: TRENDnet Router · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, Command injection
- [TRENDnet TEW-823DRU admin.cgi command injection](https://agentprime.io/advisories/CVE-2026-75984.md)
  `CVE-2026-75984` · CVE record: TRENDnet TEW-823DRU · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, Command injection
- [Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields](https://agentprime.io/advisories/GHSA-5rw4-4665-cvwf.md)
  `GHSA-5rw4-4665-cvwf`, `CVE-2026-54543`, `PKSA-prvy-3kk5-2fyv` · Packagist `froxlor/froxlor`: affected `<2.3.8`, fixed in `2.3.8` · CVSS 5.4 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection, CWE-20
- [MeshCentral has unsanitized data fields](https://agentprime.io/advisories/GHSA-c7hr-448w-65px.md)
  `GHSA-c7hr-448w-65px` · npm `meshcentral`: affected `<1.1.60`, fixed in `1.1.60` · CVSS 8.3 High · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection, CWE-20
- [xianrendzw EasyReport Move Operations ModuleController.java sql injection](https://agentprime.io/advisories/CVE-2026-75876.md)
  `CVE-2026-75876` · CVE record: xianrendzw EasyReport · CVSS 5.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection, SQL injection
- [Forem: Stored XSS in Admin Abuse Report Rendering](https://agentprime.io/advisories/CVE-2026-61696.md)
  `CVE-2026-61696` · CVE record: forem forem · CVSS 6.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection, Cross-site scripting (XSS), CWE-116
- [ePA 3.x Integration: HTTP Header Injection in VAU Inner Requests](https://agentprime.io/advisories/CVE-2026-50576.md)
  `CVE-2026-50576` · CVE record: fbeta-GmbH ePA3-Service-OpenSource · CVSS 6.8 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection
- [Joomla! Core - \[20260802\] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2](https://agentprime.io/advisories/CVE-2026-71573.md)
  `CVE-2026-71573` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.9 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection
- [Joomla! Core - \[20260801\] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2](https://agentprime.io/advisories/CVE-2026-71572.md)
  `CVE-2026-71572` · CVE record: Joomla! Project Joomla! CMS · CVSS 4.8 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection
- [MyBB: Email User CRLF injection](https://agentprime.io/advisories/CVE-2026-45125.md)
  `CVE-2026-45125` · CVE record: mybb mybb · CVSS 5.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection
- [CVE-2026-19501](https://agentprime.io/advisories/CVE-2026-19501.md)
  `CVE-2026-19501` · CVE record: SureForms SureForms · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection
- [code-projects Task Management System Login Form index.php select_with_multiple_condition sql injection](https://agentprime.io/advisories/CVE-2026-75778.md)
  `CVE-2026-75778` · CVE record: code-projects Task Management System · CVSS 6.9 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection, SQL injection
- [PHPGurukul Complaint Management System check_availability.php sql injection](https://agentprime.io/advisories/CVE-2026-75089.md)
  `CVE-2026-75089` · CVE record: PHPGurukul Complaint Management System · CVSS 6.9 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System viewbilling.php sql injection](https://agentprime.io/advisories/CVE-2026-75088.md)
  `CVE-2026-75088` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System viewdepartment.php sql injection](https://agentprime.io/advisories/CVE-2026-75087.md)
  `CVE-2026-75087` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System viewroom.php sql injection](https://agentprime.io/advisories/CVE-2026-75086.md)
  `CVE-2026-75086` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection, SQL injection
- [Webkul Bagisto Customer-Registration Notification Email register cross site scripting](https://agentprime.io/advisories/CVE-2026-75082.md)
  `CVE-2026-75082` · CVE record: Webkul Bagisto · CVSS 5.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection, Cross-site scripting (XSS)
- [SourceCodester Class and Exam Timetabling System edit_subject1.php sql injection](https://agentprime.io/advisories/CVE-2026-75080.md)
  `CVE-2026-75080` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Other injection, SQL injection
- [SourceCodester Class and Exam Timetabling System edit_subject2.php sql injection](https://agentprime.io/advisories/CVE-2026-75079.md)
  `CVE-2026-75079` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Other injection, SQL injection
- [SourceCodester Pet Grooming Management Software get_barcode_data.php sql injection](https://agentprime.io/advisories/CVE-2026-75014.md)
  `CVE-2026-75014` · CVE record: SourceCodester Pet Grooming Management Software · CVSS 6.9 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Other injection, SQL injection

Newest: <https://agentprime.io/advisories/tag/injection.md>
Older: <https://agentprime.io/advisories/tag/injection.md?cursor=WyIyMDI2LTA4LTE3VDE5OjQ1OjA5LjI0MzAwMFoiLCJDVkUtMjAyNi03NTAxNCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=injection&cursor=WyIyMDI2LTA4LTIwVDIxOjExOjI3LjUyMzAwMFoiLCJHSFNBLXgzZ2gteGhqNC0zdnE4Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/injection/?cursor=WyIyMDI2LTA4LTIwVDIxOjExOjI3LjUyMzAwMFoiLCJHSFNBLXgzZ2gteGhqNC0zdnE4Il0>. Everything for agents: <https://agentprime.io/llms.txt>.