# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Fengoffice Feng Office Reorder Handlers MoreController.class.php update_dimension_order sql injection](https://agentprime.io/advisories/CVE-2026-90496.md) `CVE-2026-90496` · CVE record: Fengoffice Feng Office · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection - [Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injection](https://agentprime.io/advisories/CVE-2026-90495.md) `CVE-2026-90495` · CVE record: Fengoffice Feng Office · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection - [sanjevirau gsubs Electron index.js showQuerySuccessPage code injection](https://agentprime.io/advisories/CVE-2026-90491.md) `CVE-2026-90491` · CVE record: sanjevirau gsubs · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, Code injection - [Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection](https://agentprime.io/advisories/CVE-2026-90488.md) `CVE-2026-90488` · CVE record: Xuxueli xxl-job · CVSS 5.3 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Other injection, Code injection - [Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion](https://agentprime.io/advisories/GHSA-98q5-5qh2-7w75.md) `GHSA-98q5-5qh2-7w75`, `CVE-2026-11748` · Maven `com.linecorp.centraldogma:centraldogma-server-auth-shiro`: affected `<0.84.0`, fixed in `0.84.0` · CVSS 6.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Other injection - [WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php](https://agentprime.io/advisories/CVE-2026-89247.md) `CVE-2026-89247` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Other injection - [WWBN AVideo CSV Formula Injection via myComments.download.php](https://agentprime.io/advisories/CVE-2026-89246.md) `CVE-2026-89246` · CVE record: WWBN AVideo · CVSS 5.1 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Other injection - [MetForm < 4.1.9 - Unauthenticated Email Header Injection via Notification Reply-To](https://agentprime.io/advisories/CVE-2026-86813.md) `CVE-2026-86813` · CVE record: Unknown MetForm · CVSS 4.8 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Other injection - [Simple CAPTCHA with Cloudflare Turnstile 1.2.2 - 1.42.1 - Unauthenticated Arbitrary Shortcode Execution via Contact Form 7 Field Repopulation](https://agentprime.io/advisories/CVE-2026-85116.md) `CVE-2026-85116` · CVE record: Unknown Simple CAPTCHA with Cloudflare Turnstile · CVSS 6.5 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Other injection - [IBM webMethods Integration Server is vulnerable to an XML external entity injection (XXE) attack when processing XML data](https://agentprime.io/advisories/CVE-2026-2310.md) `CVE-2026-2310` · CVE record: IBM webMethods Integration Server · CVSS 7.8 High · Not analysed yet · Published 10 Sept 2026 · Tags: Other injection - [Duplicate Advisory: pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods](https://agentprime.io/advisories/GHSA-8h2c-ghff-mpg9.md) `GHSA-8h2c-ghff-mpg9` · PyPI `pymongo`: affected `<=4.18.0`, no fixed version yet · CVSS 8.3 High · Withdrawn · Not analysed yet · Published 10 Sept 2026 · Tags: Other injection - [Duplicate Advisory: GridFS data disclosure and deletion via query-operator injection in file IDs](https://agentprime.io/advisories/GHSA-x6mc-fgjf-77r7.md) `GHSA-x6mc-fgjf-77r7` · Packagist `mongodb/mongodb`: affected `>=1.1.0`, no fixed version yet · CVSS 8.3 High · Withdrawn · Not analysed yet · Published 10 Sept 2026 · Tags: Other injection - [GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver](https://agentprime.io/advisories/CVE-2026-88036.md) `CVE-2026-88036` · CVE record: MongoDB C Driver · CVSS 6.1 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Other injection - [GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver](https://agentprime.io/advisories/CVE-2026-88034.md) `CVE-2026-88034` · CVE record: MongoDB C++ Driver · CVSS 6.1 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Other injection - [GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver](https://agentprime.io/advisories/CVE-2026-88033.md) `CVE-2026-88033` · CVE record: MongoDB Java Driver · CVSS 6.1 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Other injection - [GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver](https://agentprime.io/advisories/CVE-2026-88031.md) `CVE-2026-88031` · CVE record: MongoDB Go Driver · CVSS 6.1 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Other injection - [GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Ruby Driver](https://agentprime.io/advisories/CVE-2026-88030.md) `CVE-2026-88030` · CVE record: MongoDB Ruby Driver · CVSS 6.1 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Other injection - [Unauthorized document disclosure via query-operator injection in polymorphic relation identifiers in MongoDB integration for Laravel](https://agentprime.io/advisories/CVE-2026-88028.md) `CVE-2026-88028` · CVE record: MongoDB Laravel MongoDB (PHP) · CVSS 7.1 High · Not analysed yet · Published 10 Sept 2026 · Tags: Other injection - [Mass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for Laravel](https://agentprime.io/advisories/CVE-2026-88027.md) `CVE-2026-88027` · CVE record: MongoDB Laravel MongoDB (PHP) · CVSS 7.1 High · Not analysed yet · Published 10 Sept 2026 · Tags: Other injection - [Regular expression injection via unescaped characters in LINQ query translation in MongoDB C# Driver](https://agentprime.io/advisories/CVE-2026-88026.md) `CVE-2026-88026` · CVE record: MongoDB C# Driver · CVSS 7.1 High · Not analysed yet · Published 10 Sept 2026 · Tags: Other injection - [GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# Driver](https://agentprime.io/advisories/CVE-2026-88025.md) `CVE-2026-88025` · CVE record: MongoDB C# Driver · CVSS 6.1 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Other injection - [GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust Driver](https://agentprime.io/advisories/CVE-2026-88024.md) `CVE-2026-88024` · CVE record: MongoDB Rust Driver · CVSS 6.1 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Other injection - [Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel](https://agentprime.io/advisories/CVE-2026-88022.md) `CVE-2026-88022` · CVE record: MongoDB Laravel MongoDB (PHP) · CVSS 8.4 High · Not analysed yet · Published 10 Sept 2026 · Tags: Other injection - [cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options](https://agentprime.io/advisories/CVE-2026-88038.md) `CVE-2026-88038` · CVE record: cookies cookies · CVSS 4.8 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Other injection - [Rizwan17 inventory-management-system manage.php storeCustomerOrderInvoice sql injection](https://agentprime.io/advisories/CVE-2026-87925.md) `CVE-2026-87925` · CVE record: Rizwan17 inventory-management-system · CVSS 6.9 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Other injection, SQL injection - [Rizwan17 inventory-management-system manage.php update_record sql injection](https://agentprime.io/advisories/CVE-2026-87921.md) `CVE-2026-87921` · CVE record: Rizwan17 inventory-management-system · CVSS 6.9 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Other injection, SQL injection - [Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export](https://agentprime.io/advisories/CVE-2026-86745.md) `CVE-2026-86745` · CVE record: grokability snipe-it · CVSS 5.1 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Other injection - [Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report](https://agentprime.io/advisories/CVE-2026-86742.md) `CVE-2026-86742` · CVE record: grokability snipe-it · CVSS 5.1 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Other injection - [CSV injection in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-79971.md) `CVE-2026-79971` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Other injection - [LDAP injection in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-80055.md) `CVE-2026-80055` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 4.4 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Other injection - [Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation](https://agentprime.io/advisories/CVE-2026-85117.md) `CVE-2026-85117` · CVE record: Unknown Contact Form 7 Captcha · CVSS 6.5 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Other injection - [Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders](https://agentprime.io/advisories/CVE-2026-80440.md) `CVE-2026-80440` · CVE record: Unknown Hustle · CVSS 4.8 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Other injection - [Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text](https://agentprime.io/advisories/CVE-2026-19855.md) `CVE-2026-19855` · CVE record: Unknown CleanTalk · CVSS 6.5 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Other injection - [Injection in Google Chrome](https://agentprime.io/advisories/CVE-2026-87572.md) `CVE-2026-87572` · CVE record: Google Chrome · CVSS 8.3 High · Not analysed yet · Published 9 Sept 2026 · Tags: Other injection - [morgan vulnerable to Log Forging via unescaped Unicode line separators](https://agentprime.io/advisories/GHSA-jxfw-x594-9x9m.md) `GHSA-jxfw-x594-9x9m`, `CVE-2026-15603` · npm `morgan`: affected `<1.12.0`, fixed in `1.12.0` · CVSS 5.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Other injection - [mongodb: Reject "." and NUL bytes in database and collection names](https://agentprime.io/advisories/GHSA-65fr-j4p9-vc33.md) `GHSA-65fr-j4p9-vc33`, `CVE-2026-81525`, `PKSA-61k5-cqr9-b8b4` · Packagist `mongodb/mongodb`: affected `<1.21.4 || >=2.0.0, <2.4.1`, fixed in `1.21.4`, `2.4.1` · CVSS 8.6 High · Not analysed yet · Published 8 Sept 2026 · Tags: Other injection - [xmldom: Processing Instruction Target Injection Bypasses requireWellFormed](https://agentprime.io/advisories/GHSA-c7q8-3ch8-vqpv.md) `GHSA-c7q8-3ch8-vqpv`, `CVE-2026-83616` · npm `xmldom` and 1 more: affected `<=0.6.0`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Other injection - [xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator](https://agentprime.io/advisories/GHSA-jxjr-3g7g-3944.md) `GHSA-jxjr-3g7g-3944`, `CVE-2026-83617` · npm `@xmldom/xmldom`: affected `>=0.9.11, <0.9.12`, fixed in `0.9.12` · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Other injection, CWE-625 - [xmldom: DocType \`name\` Injection Bypasses requireWellFormed](https://agentprime.io/advisories/GHSA-27p8-2357-5qqv.md) `GHSA-27p8-2357-5qqv`, `CVE-2026-83608` · npm `xmldom` and 1 more: affected `<=0.6.0`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Other injection - [xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path](https://agentprime.io/advisories/GHSA-3px3-54cx-rmw9.md) `GHSA-3px3-54cx-rmw9`, `CVE-2026-83609` · npm `@xmldom/xmldom`: affected `>=0.9.0, <0.9.12`, fixed in `0.9.12` · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Other injection, CWE-625 - [xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator](https://agentprime.io/advisories/GHSA-vr34-hp96-76pp.md) `GHSA-vr34-hp96-76pp`, `CVE-2026-83618` · npm `@xmldom/xmldom`: affected `>=0.9.10, <0.9.12`, fixed in `0.9.12` · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Other injection, CWE-625 - [Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections](https://agentprime.io/advisories/GHSA-w6f5-v2h6-g786.md) `GHSA-w6f5-v2h6-g786`, `CVE-2026-84372`, `PKSA-z888-whwt-brbj` · Packagist `predis/predis`: affected `>=3.0.0-RC1, <3.3.0`, fixed in `3.3.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Other injection - [CakePHP: SmtpTransport vulnerable to CRLF header injection](https://agentprime.io/advisories/GHSA-2qh5-382h-3jpc.md) `GHSA-2qh5-382h-3jpc`, `CVE-2026-119417`, `CVE-2026-77634`, `PKSA-rdvp-7sns-1dvh` · Packagist `cakephp/cakephp`: affected `>=4.5.0, <4.5.12 || >=4.6.0, <4.6.5 || >=5.0.0, <5.1.9 || >=5.2.0, <5.2.14 || >=5.3.0, <5.3.7`, fixed in `4.5.12`, `4.6.5`, `5.1.9`, `5.2.14`, `5.3.7` · CVSS 8.2 High · Not analysed yet · Published 8 Sept 2026 · Tags: Other injection - [HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers](https://agentprime.io/advisories/GHSA-h4x7-gw46-3wm6.md) `GHSA-h4x7-gw46-3wm6`, `CVE-2026-84379`, `PYSEC-2026-3848` · PyPI `httpx2`: affected `<2.11.0`, fixed in `2.11.0` · CVSS 5.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Other injection - [xmldom: Element name injection via createElement() bypasses requireWellFormed](https://agentprime.io/advisories/GHSA-w2rr-34g9-rvrj.md) `GHSA-w2rr-34g9-rvrj`, `CVE-2026-83607` · npm `xmldom` and 1 more: affected `<=0.6.0`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Other injection - [xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed](https://agentprime.io/advisories/GHSA-4w3w-2rp5-g8jm.md) `GHSA-4w3w-2rp5-g8jm`, `CVE-2026-83605` · npm `xmldom` and 1 more: affected `<=0.6.0`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Other injection - [Improper Input Sanitization in Okta Access Gateway LDAP Datastore Filter Interpolation](https://agentprime.io/advisories/CVE-2026-78579.md) `CVE-2026-78579` · CVE record: Okta Okta Access Gateway · CVSS 6.8 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Other injection - [itsourcecode Sales and Inventory System us_edit.php sql injection](https://agentprime.io/advisories/CVE-2026-86675.md) `CVE-2026-86675` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Other injection, SQL injection - [Microsoft SQL Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-65669.md) `CVE-2026-65669` · CVE record: Microsoft SQL Server Management Studio 22 · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Other injection - [aircheng-org iWebShop-5 member.php member_list sql injection](https://agentprime.io/advisories/CVE-2026-86667.md) `CVE-2026-86667` · CVE record: aircheng-org iWebShop-5 · CVSS 5.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Other injection, SQL injection - [Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups](https://agentprime.io/advisories/CVE-2026-82060.md) `CVE-2026-82060` · CVE record: MongoDB MongoDB Server · CVSS 2.3 Low · Not analysed yet · Published 8 Sept 2026 · Tags: Other injection - [code-projects Student Crud Operation edit.php sql injection](https://agentprime.io/advisories/CVE-2026-86518.md) `CVE-2026-86518` · CVE record: code-projects Student Crud Operation · CVSS 5.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System us_searchfrm.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-86517.md) `CVE-2026-86517` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System cust_edit1.php sql injection](https://agentprime.io/advisories/CVE-2026-86310.md) `CVE-2026-86310` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System pro_searchfrm.php sql injection](https://agentprime.io/advisories/CVE-2026-86309.md) `CVE-2026-86309` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Class and Exam Timetabling System delete_subject.php sql injection](https://agentprime.io/advisories/CVE-2026-86298.md) `CVE-2026-86298` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Other injection, SQL injection - [D-Link DIR-895L udhcpcd serverpacket.c sendACK command injection](https://agentprime.io/advisories/CVE-2026-86295.md) `CVE-2026-86295` · CVE record: D-Link DIR-895L · CVSS 6.9 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Other injection, Command injection - [itsourcecode Sales and Inventory System us_edit1.php sql injection](https://agentprime.io/advisories/CVE-2026-86291.md) `CVE-2026-86291` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Voting System ajax.php save_category sql injection](https://agentprime.io/advisories/CVE-2026-86290.md) `CVE-2026-86290` · CVE record: SourceCodester Online Voting System · CVSS 6.9 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Other injection, SQL injection - [jaychouchannel Tourism-Management-System CommonDao CommonController.java sql injection](https://agentprime.io/advisories/CVE-2026-86282.md) `CVE-2026-86282` · CVE record: jaychouchannel Tourism-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Other injection, SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .