# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass](https://agentprime.io/advisories/GHSA-j9v4-rhgr-4m5f.md) `GHSA-j9v4-rhgr-4m5f`, `CVE-2026-77360` · npm `@orpc/server`: affected `<1.14.8`, fixed in `1.14.8` · CVSS 6.3 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Other injection - [Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses](https://agentprime.io/advisories/CVE-2026-85077.md) `CVE-2026-85077` · CVE record: sanic-org sanic · CVSS 8.2 High · Not analysed yet · Published 17 Sept 2026 · Tags: Other injection - [Log injection via an unescaped password reset identity in AshAuthentication](https://agentprime.io/advisories/GHSA-wg7g-r393-vr3g.md) `GHSA-wg7g-r393-vr3g`, `CVE-2026-86522`, `EEF-CVE-2026-86522` · Hex `ash_authentication`: affected `>=4.2.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 6.3 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Other injection - [Cisco Identity Search Engine SXP REST API SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-20284.md) `CVE-2026-20284` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection - [Cisco Identity Services Engine Hardening Release - Improper Neutralization Vulnerabilities](https://agentprime.io/advisories/CVE-2026-20130.md) `CVE-2026-20130` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection - [itsourcecode Leave Management System index.php sql injection](https://agentprime.io/advisories/CVE-2026-92526.md) `CVE-2026-92526` · CVE record: itsourcecode Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Inventory and Monitoring System btn_functions.php add sql injection](https://agentprime.io/advisories/CVE-2026-92406.md) `CVE-2026-92406` · CVE record: SourceCodester Inventory and Monitoring System · CVSS 6.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Inventory and Monitoring System index.php sql injection](https://agentprime.io/advisories/CVE-2026-92405.md) `CVE-2026-92405` · CVE record: SourceCodester Inventory and Monitoring System · CVSS 6.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection, SQL injection - [Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment](https://agentprime.io/advisories/CVE-2026-90999.md) `CVE-2026-90999` · CVE record: Functional Software, Inc. Sentry Seer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection, Code injection, CWE-20, CWE-116 - [code-projects Matrimonial System Regular Search search.php sql injection](https://agentprime.io/advisories/CVE-2026-92366.md) `CVE-2026-92366` · CVE record: code-projects Matrimonial System · CVSS 6.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection, SQL injection - [Injection in Jenkins Project Jenkins Gradle Plugin](https://agentprime.io/advisories/CVE-2026-92132.md) `CVE-2026-92132` · CVE record: Jenkins Project Jenkins Gradle Plugin · CVSS 5.4 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection - [itsourcecode Leave Management System index.php sql injection](https://agentprime.io/advisories/CVE-2026-92364.md) `CVE-2026-92364` · CVE record: itsourcecode Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection, SQL injection - [Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider](https://agentprime.io/advisories/CVE-2026-84501.md) `CVE-2026-84501` · CVE record: Apache Software Foundation Apache ZooKeeper · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection - [Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources](https://agentprime.io/advisories/CVE-2026-84439.md) `CVE-2026-84439` · CVE record: Apache Software Foundation Apache ZooKeeper · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection - [Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via \[entry_key\] Custom HTML Token](https://agentprime.io/advisories/CVE-2026-19857.md) `CVE-2026-19857` · CVE record: Unknown Formidable Forms · CVSS 4.8 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection - [gedelumbung HospitalManagement app_global_admin_model.php generate_index_pasien sql injection](https://agentprime.io/advisories/CVE-2026-92221.md) `CVE-2026-92221` · CVE record: gedelumbung HospitalManagement · CVSS 5.1 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection, SQL injection - [a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection](https://agentprime.io/advisories/CVE-2026-92213.md) `CVE-2026-92213` · CVE record: a2ui-project a2ui · CVSS 5.1 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection, CWE-707 - [Http4s: Set-Cookie rendering does not escape attribute delimiters](https://agentprime.io/advisories/CVE-2026-69211.md) `CVE-2026-69211` · CVE record: http4s http4s · CVSS 4.8 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, CWE-1286 - [Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.](https://agentprime.io/advisories/CVE-2026-11864.md) `CVE-2026-11864` · CVE record: IBM Cloud Pak for Business Automation · CVSS 6.5 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection - [Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-11927.md) `CVE-2026-11927` · CVE record: IBM Verify Identity Access and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection - [IBM MQ is vulnerable to unauthenticated remote code execution via JNDI injection](https://agentprime.io/advisories/CVE-2026-12351.md) `CVE-2026-12351` · CVE record: IBM MQ · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection - [IBM MQ Resource Adapter IVT servlet is vulnerable to unauthenticated remote code execution](https://agentprime.io/advisories/CVE-2026-12355.md) `CVE-2026-12355` · CVE record: IBM MQ · CVSS 8.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection - [gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection](https://agentprime.io/advisories/CVE-2026-91986.md) `CVE-2026-91986` · CVE record: GitoxideLabs gitoxide · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection - [Flowise before 3.1.4 NoSQL Injection via sessionId](https://agentprime.io/advisories/CVE-2026-91937.md) `CVE-2026-91937` · CVE record: FlowiseAI Flowise · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection - [WuzhiCMS index.php getDataOfJson sql injection](https://agentprime.io/advisories/CVE-2026-91848.md) `CVE-2026-91848` · CVE record: WuzhiCMS · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Faculty Clearance System delete_faculty1.php sql injection](https://agentprime.io/advisories/CVE-2026-91004.md) `CVE-2026-91004` · CVE record: SourceCodester Online Faculty Clearance System · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, SQL injection - [D-Link DSL-3782 Diagnostics Diagnostics.asp system command injection](https://agentprime.io/advisories/CVE-2026-90880.md) `CVE-2026-90880` · CVE record: D-Link DSL-3782 · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, Command injection - [zyx0814 FilePress Publish search.php sql injection](https://agentprime.io/advisories/CVE-2026-90879.md) `CVE-2026-90879` · CVE record: zyx0814 FilePress · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Faculty Clearance System update_requirement_status.php sql injection](https://agentprime.io/advisories/CVE-2026-90877.md) `CVE-2026-90877` · CVE record: SourceCodester Online Faculty Clearance System · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Faculty Clearance System delete_requirement.php sql injection](https://agentprime.io/advisories/CVE-2026-90876.md) `CVE-2026-90876` · CVE record: SourceCodester Online Faculty Clearance System · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester/katojkalemba Online Food Ordering System order.php sql injection](https://agentprime.io/advisories/CVE-2026-90855.md) `CVE-2026-90855` · CVE record: SourceCodester Online Food Ordering System and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester/katojkalemba Online Food Ordering System category-foods.php sql injection](https://agentprime.io/advisories/CVE-2026-90854.md) `CVE-2026-90854` · CVE record: SourceCodester Online Food Ordering System and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester College Notes Gallery Management System login.php sql injection](https://agentprime.io/advisories/CVE-2026-90849.md) `CVE-2026-90849` · CVE record: SourceCodester College Notes Gallery Management System · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, SQL injection - [PHPGurukul Daily Expense Tracker System forgot-password.php sql injection](https://agentprime.io/advisories/CVE-2026-90846.md) `CVE-2026-90846` · CVE record: PHPGurukul Daily Expense Tracker System · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, SQL injection - [PHPGurukul Daily Expense Tracker System Login index.php sql injection](https://agentprime.io/advisories/CVE-2026-90844.md) `CVE-2026-90844` · CVE record: PHPGurukul Daily Expense Tracker System · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, SQL injection - [PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection](https://agentprime.io/advisories/CVE-2026-90841.md) `CVE-2026-90841` · CVE record: PHPGurukul Blood Donor Management System · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection, SQL injection - [a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting](https://agentprime.io/advisories/CVE-2026-90819.md) `CVE-2026-90819` · CVE record: a2aproject a2a-java · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection - [IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-16188.md) `CVE-2026-16188` · CVE record: IBM WebSphere Application Server · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection - [IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-16189.md) `CVE-2026-16189` · CVE record: IBM WebSphere Application Server · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection - [HKUDS nanobot ExecTool shell.py ExecTool.\_spawn argument injection](https://agentprime.io/advisories/CVE-2026-90809.md) `CVE-2026-90809` · CVE record: HKUDS nanobot · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection, Command injection - [subhajitkhan online-clinic-management-system doctorlogin.php sql injection](https://agentprime.io/advisories/CVE-2026-90805.md) `CVE-2026-90805` · CVE record: subhajitkhan online-clinic-management-system · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Leave Management System index.php sql injection](https://agentprime.io/advisories/CVE-2026-90796.md) `CVE-2026-90796` · CVE record: itsourcecode Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Leave Management System login.php sql injection](https://agentprime.io/advisories/CVE-2026-90789.md) `CVE-2026-90789` · CVE record: itsourcecode Leave Management System · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection, SQL injection - [froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL](https://agentprime.io/advisories/CVE-2026-90937.md) `CVE-2026-90937` · CVE record: froxlor froxlor · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection - [Yot CMS Admin Console admin.php eval code injection](https://agentprime.io/advisories/CVE-2026-90709.md) `CVE-2026-90709` · CVE record: Yot CMS · CVSS 5.1 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection, Code injection - [Yot CMS Cookie global.php login sql injection](https://agentprime.io/advisories/CVE-2026-90708.md) `CVE-2026-90708` · CVE record: Yot CMS · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection, SQL injection - [D-Link DWR-M921 formDiskPartition system command injection](https://agentprime.io/advisories/CVE-2026-90704.md) `CVE-2026-90704` · CVE record: D-Link DWR-M921 · CVSS 5.1 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection, Command injection - [subhajitkhan online-clinic-management-system listdoctor.php sql injection](https://agentprime.io/advisories/CVE-2026-90701.md) `CVE-2026-90701` · CVE record: subhajitkhan online-clinic-management-system · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System pro_edit1.php sql injection](https://agentprime.io/advisories/CVE-2026-90700.md) `CVE-2026-90700` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System inv_edit1.php sql injection](https://agentprime.io/advisories/CVE-2026-90600.md) `CVE-2026-90600` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System sup_edit1.php sql injection](https://agentprime.io/advisories/CVE-2026-90597.md) `CVE-2026-90597` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection - [cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection](https://agentprime.io/advisories/CVE-2026-90581.md) `CVE-2026-90581` · CVE record: cym1102 nginxWebUI · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, Code injection - [itsourcecode Sales and Inventory System emp_transac.php add sql injection](https://agentprime.io/advisories/CVE-2026-90574.md) `CVE-2026-90574` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester School Registration and Fee System save_class.php sql injection](https://agentprime.io/advisories/CVE-2026-90526.md) `CVE-2026-90526` · CVE record: SourceCodester School Registration and Fee System · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System cust_pos_trans.php sql injection](https://agentprime.io/advisories/CVE-2026-90525.md) `CVE-2026-90525` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester School Registration and Fee System pay_report.php sql injection](https://agentprime.io/advisories/CVE-2026-90516.md) `CVE-2026-90516` · CVE record: SourceCodester School Registration and Fee System · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester School Registration and Fee System delete_stud.php sql injection](https://agentprime.io/advisories/CVE-2026-90515.md) `CVE-2026-90515` · CVE record: SourceCodester School Registration and Fee System · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester School Registration and Fee System save_stud.php sql injection](https://agentprime.io/advisories/CVE-2026-90514.md) `CVE-2026-90514` · CVE record: SourceCodester School Registration and Fee System · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection - [Froxlor before 2.3.12 SSH Key Injection via authorized_keys](https://agentprime.io/advisories/CVE-2026-90767.md) `CVE-2026-90767` · CVE record: froxlor Froxlor · CVSS 7.1 High · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection - [GongShengyue OnlineBooks listSplit BooksServlet.java sql injection](https://agentprime.io/advisories/CVE-2026-90511.md) `CVE-2026-90511` · CVE record: GongShengyue OnlineBooks · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .