# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection](https://agentprime.io/advisories/CVE-2026-2811.md) `CVE-2026-2811` · CVE record: Unknown Ajaxify Comments · CVSS 5.4 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Other injection - [Brave Popup Builder < 0.8.8 - Unauthenticated Arbitrary Shortcode Execution via UTM Parameter](https://agentprime.io/advisories/CVE-2026-81571.md) `CVE-2026-81571` · CVE record: Unknown Brave · CVSS 4.8 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Other injection - [GutenKit < 2.5.1 - Contributor+ Stored CSS Injection](https://agentprime.io/advisories/CVE-2026-19698.md) `CVE-2026-19698` · CVE record: Unknown GutenKit · CVSS 3.5 Low · Not analysed yet · Published 2 Sept 2026 · Tags: Other injection - [Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE](https://agentprime.io/advisories/CVE-2026-10821.md) `CVE-2026-10821` · CVE record: Unknown Yoast SEO Premium · CVSS 6.6 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Other injection - [LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115](https://agentprime.io/advisories/CVE-2026-81205.md) `CVE-2026-81205` · CVE record: Drupal LDAP / Active Directory Integration · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Other injection - [Template injection in Eclipse Foundation Eclipse Ditto](https://agentprime.io/advisories/CVE-2026-82958.md) `CVE-2026-82958` · CVE record: Eclipse Foundation Eclipse Ditto · CVSS 7.6 High · Not analysed yet · Published 2 Sept 2026 · Tags: Other injection, Code injection, CWE-116 - [Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive \`\*\*kwargs\` path in \`set_cookie\`](https://agentprime.io/advisories/GHSA-wwv5-g3v4-889x.md) `GHSA-wwv5-g3v4-889x`, `CVE-2026-91991` · PyPI `tornado`: affected `>=6.5.5, <6.5.8`, fixed in `6.5.8` · CVSS 6.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Other injection - [Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-63138.md) `CVE-2026-63138` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Other injection - [Xinhu Rainrock RockOA index.php toaddval sql injection](https://agentprime.io/advisories/CVE-2026-84153.md) `CVE-2026-84153` · CVE record: Xinhu Rainrock RockOA · CVSS 5.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Other injection, SQL injection - [Chanjet CRM jxf_dump_table.php sql injection](https://agentprime.io/advisories/CVE-2026-84111.md) `CVE-2026-84111` · CVE record: Chanjet CRM · CVSS 6.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Other injection, SQL injection - [Xinhu Rainrock RockOA webmainAction.php getOrder sql injection](https://agentprime.io/advisories/CVE-2026-84109.md) `CVE-2026-84109` · CVE record: Xinhu Rainrock RockOA · CVSS 5.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Other injection, SQL injection - [zhongyu09 OpenChatBI generate_sql.py \_validate_sql_safety sql injection](https://agentprime.io/advisories/CVE-2026-84061.md) `CVE-2026-84061` · CVE record: zhongyu09 OpenChatBI · CVSS 5.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Other injection, SQL injection - [ICP DAS UA-2200/UA-5200 CGI ArmAngstromInstructionSet command injection](https://agentprime.io/advisories/CVE-2026-84059.md) `CVE-2026-84059` · CVE record: ICP DAS UA-2200 and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Other injection, Command injection - [MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution via Completion Message Merge Tags](https://agentprime.io/advisories/CVE-2026-78363.md) `CVE-2026-78363` · CVE record: Unknown MW WP Form · CVSS 4.8 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Other injection - [Cobham SATCOM VSAT7090 Maritime Satellite Router JSON Parsing mail-report.sh c_set_reports_decode command injection](https://agentprime.io/advisories/CVE-2026-83772.md) `CVE-2026-83772` · CVE record: Cobham SATCOM VSAT7090 Maritime Satellite Router · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Other injection, Command injection - [RedPort Optimizer wXa-223 System Clock datetime.php exec command injection](https://agentprime.io/advisories/CVE-2026-83524.md) `CVE-2026-83524` · CVE record: RedPort Optimizer wXa-203 and 2 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, Command injection - [QVidium Opera11 CGI Script net_tr.cgi command injection](https://agentprime.io/advisories/CVE-2026-82971.md) `CVE-2026-82971` · CVE record: QVidium Opera11 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, Command injection - [ShopEx ECShop flow.php flow_update_cart sql injection](https://agentprime.io/advisories/CVE-2026-82922.md) `CVE-2026-82922` · CVE record: ShopEx ECShop · CVSS 6.9 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, SQL injection - [Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export](https://agentprime.io/advisories/CVE-2026-77353.md) `CVE-2026-77353` · CVE record: ellite Wallos · CVSS 4.6 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, CWE-116 - [kishan0725 Hospital-Management-System search.php sql injection](https://agentprime.io/advisories/CVE-2026-82914.md) `CVE-2026-82914` · CVE record: kishan0725 Hospital-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, SQL injection - [code-projects Online Shopping System Search Functionality action.php sql injection](https://agentprime.io/advisories/CVE-2026-82701.md) `CVE-2026-82701` · CVE record: code-projects Online Shopping System · CVSS 6.9 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System inv_searchfrm.php sql injection](https://agentprime.io/advisories/CVE-2026-82696.md) `CVE-2026-82696` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, SQL injection - [yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection](https://agentprime.io/advisories/CVE-2026-82666.md) `CVE-2026-82666` · CVE record: yaojingang GEOFlow · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, Code injection - [Soarkey StudentManagement/学生信息管理系统 CourseDao.java CourseDao.course_ranking sql injection](https://agentprime.io/advisories/CVE-2026-82620.md) `CVE-2026-82620` · CVE record: Soarkey StudentManagement and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Medicine Delivery System Password Recovery passwordrecover.php find_phone sql injection](https://agentprime.io/advisories/CVE-2026-82615.md) `CVE-2026-82615` · CVE record: itsourcecode Online Medicine Delivery System · CVSS 6.9 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Medicine Delivery System Product Category Filter index.php loadResultList sql injection](https://agentprime.io/advisories/CVE-2026-82614.md) `CVE-2026-82614` · CVE record: itsourcecode Online Medicine Delivery System · CVSS 6.9 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Medicine Delivery System Product Search index.php loadResultList sql injection](https://agentprime.io/advisories/CVE-2026-82613.md) `CVE-2026-82613` · CVE record: itsourcecode Online Medicine Delivery System · CVSS 6.9 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Medicine Delivery System Product Detail index.php loadResultList sql injection](https://agentprime.io/advisories/CVE-2026-82612.md) `CVE-2026-82612` · CVE record: itsourcecode Online Medicine Delivery System · CVSS 6.9 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Medicine Delivery System Customer Login login.php cusAuthentication sql injection](https://agentprime.io/advisories/CVE-2026-82611.md) `CVE-2026-82611` · CVE record: itsourcecode Online Medicine Delivery System · CVSS 6.9 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Medicine Delivery System Login login.php employeeAuthentication sql injection](https://agentprime.io/advisories/CVE-2026-82610.md) `CVE-2026-82610` · CVE record: itsourcecode Online Medicine Delivery System · CVSS 6.9 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System inv_edit.php sql injection](https://agentprime.io/advisories/CVE-2026-82609.md) `CVE-2026-82609` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, SQL injection - [SeaCMS zyapi.php sql injection](https://agentprime.io/advisories/CVE-2026-82600.md) `CVE-2026-82600` · CVE record: SeaCMS · CVSS 6.9 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, SQL injection - [SeaCMS Template search.php parseIf code injection](https://agentprime.io/advisories/CVE-2026-82598.md) `CVE-2026-82598` · CVE record: SeaCMS · CVSS 6.9 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, Code injection - [TOTOLINK NR1800X cstecgi.cgi setUssd command injection](https://agentprime.io/advisories/CVE-2026-82597.md) `CVE-2026-82597` · CVE record: TOTOLINK NR1800X · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, Command injection - [FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint.](https://agentprime.io/advisories/CVE-2026-79483.md) `CVE-2026-79483` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection - [D-Link DIR-825M System Command Execution formSysCmd sub_456CF4 command injection](https://agentprime.io/advisories/CVE-2026-82595.md) `CVE-2026-82595` · CVE record: D-Link DIR-825M · CVSS 5.3 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Other injection, Command injection - [itsourcecode Sales and Inventory System sup_searchfrm.php sql injection](https://agentprime.io/advisories/CVE-2026-82545.md) `CVE-2026-82545` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System sup_edit.php sql injection](https://agentprime.io/advisories/CVE-2026-82541.md) `CVE-2026-82541` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Other injection, SQL injection - [Unescaped backslash allows LIKE wildcard injection in AshSql string search](https://agentprime.io/advisories/GHSA-5jgp-7mhc-6qqh.md) `GHSA-5jgp-7mhc-6qqh`, `CVE-2026-78691`, `EEF-CVE-2026-78691` · Hex `ash_sql`: affected `>=0.1.1-rc.10, <0.7.1`, fixed in `0.7.1` · CVSS 2.1 Low · Not analysed yet · Published 30 Aug 2026 · Tags: Other injection - [itsourcecode Sales and Inventory System cust_searchfrm.php sql injection](https://agentprime.io/advisories/CVE-2026-82540.md) `CVE-2026-82540` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System pro_edit.php sql injection](https://agentprime.io/advisories/CVE-2026-82485.md) `CVE-2026-82485` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System emp_searchfrm.php sql injection](https://agentprime.io/advisories/CVE-2026-82484.md) `CVE-2026-82484` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Other injection, SQL injection - [JSON path injection via unescaped get_path segments in AshSqlite](https://agentprime.io/advisories/GHSA-hrp2-5hgw-c83c.md) `GHSA-hrp2-5hgw-c83c`, `CVE-2026-77846`, `EEF-CVE-2026-77846` · Hex `ash_sqlite`: affected `>=0.1.2-rc.0, <0.2.18`, fixed in `0.2.18` · CVSS 2.1 Low · Not analysed yet · Published 30 Aug 2026 · Tags: Other injection - [PHPGurukul Student Information System student_edit1.php sql injection](https://agentprime.io/advisories/CVE-2026-82424.md) `CVE-2026-82424` · CVE record: PHPGurukul Student Information System · CVSS 5.3 Medium · Not analysed yet · Published 29 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System emp_del.php sql injection](https://agentprime.io/advisories/CVE-2026-82422.md) `CVE-2026-82422` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 29 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System emp_edit.php sql injection](https://agentprime.io/advisories/CVE-2026-82421.md) `CVE-2026-82421` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 29 Aug 2026 · Tags: Other injection, SQL injection - [MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports](https://agentprime.io/advisories/CVE-2026-76797.md) `CVE-2026-76797` · CVE record: MongoDB BI Connector Transition Readiness Report · CVSS 5.8 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Other injection - [Snipe-IT has CSV formula injection in Activity Report export](https://agentprime.io/advisories/GHSA-whrx-mmgr-gpcf.md) `GHSA-whrx-mmgr-gpcf`, `CVE-2026-55452`, `PKSA-cj32-qmb9-vwgy` · Packagist `snipe/snipe-it`: affected `<8.6.2`, fixed in `8.6.2` · CVSS 4.8 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Other injection - [CRLF injection in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-33606.md) `CVE-2026-33606` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Other injection - [Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters](https://agentprime.io/advisories/CVE-2026-16759.md) `CVE-2026-16759` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 6.5 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Other injection - [aiosmtplib: STARTTLS response injection](https://agentprime.io/advisories/GHSA-vxj7-4xrp-5vr4.md) `GHSA-vxj7-4xrp-5vr4`, `CVE-2026-55558`, `PYSEC-2026-3805` · PyPI `aiosmtplib`: affected `<5.1.2`, fixed in `5.1.2` · CVSS 5.9 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection - [cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing](https://agentprime.io/advisories/CVE-2026-77341.md) `CVE-2026-77341` · CVE record: yhirose cpp-httplib · CVSS 5.3 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection - [RooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection](https://agentprime.io/advisories/CVE-2026-81835.md) `CVE-2026-81835` · CVE record: RooCodeInc Roo-Code · CVSS 5.1 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection, Code injection - [RooCodeInc Roo-Code README File ExecaTerminalProcess code injection](https://agentprime.io/advisories/CVE-2026-81834.md) `CVE-2026-81834` · CVE record: RooCodeInc Roo-Code · CVSS 5.3 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection, Code injection - [RooCodeInc Roo-Code CodeIndexManager helpers.ts optimizeQuery code injection](https://agentprime.io/advisories/CVE-2026-81833.md) `CVE-2026-81833` · CVE record: RooCodeInc Roo-Code · CVSS 5.1 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection, Code injection - [NoSQL injection via array replacement bypassing update shape validation in driver write path](https://agentprime.io/advisories/CVE-2026-81528.md) `CVE-2026-81528` · CVE record: MongoDB C# Driver · CVSS 5.3 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection - [NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation](https://agentprime.io/advisories/CVE-2026-81527.md) `CVE-2026-81527` · CVE record: MongoDB C# Driver · CVSS 6.9 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection - [Cross-database write redirection via unvalidated dotted database name in bulk write namespaces](https://agentprime.io/advisories/CVE-2026-81526.md) `CVE-2026-81526` · CVE record: MongoDB Rust Driver · CVSS 7.1 High · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection - [Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt](https://agentprime.io/advisories/CVE-2026-81523.md) `CVE-2026-81523` · CVE record: MongoDB libmongocrypt · CVSS 2.0 Low · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection - [RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure](https://agentprime.io/advisories/CVE-2026-59319.md) `CVE-2026-59319` · CVE record: Spring Spring AI · CVSS 4.3 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .