# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [morgan vulnerable to Log Injection via unescaped double quote in quoted log fields](https://agentprime.io/advisories/GHSA-9f6g-j8ch-79g4.md) `GHSA-9f6g-j8ch-79g4`, `CVE-2026-87859` · npm `morgan`: affected `<1.12.1`, fixed in `1.12.1` · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection - [Ziroom ZHOME A0101 USB Device Management API zrUsb.lua pop_usb_device command injection](https://agentprime.io/advisories/CVE-2026-101187.md) `CVE-2026-101187` · CVE record: Ziroom ZHOME A0101 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, Command injection - [Eleveo Call Recording Software User Management userAddAction.do ldap injection](https://agentprime.io/advisories/CVE-2026-101145.md) `CVE-2026-101145` · CVE record: Eleveo Call Recording Software · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection - [code-projects Matrimonial System Profile Creation Endpoint create_profile processprofile_form sql injection](https://agentprime.io/advisories/CVE-2026-101105.md) `CVE-2026-101105` · CVE record: code-projects Matrimonial System · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, SQL injection - [Apache Karaf: LDAP filter injection in JAAS LDAP login modules](https://agentprime.io/advisories/CVE-2026-90979.md) `CVE-2026-90979` · CVE record: Apache Software Foundation Apache Karaf · CVSS 7.3 High · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection - [dayrui XunruiCMS Group Editing Home.php group_all_edit sql injection](https://agentprime.io/advisories/CVE-2026-101018.md) `CVE-2026-101018` · CVE record: dayrui XunruiCMS · CVSS 5.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project updateresultdetails.php sql injection](https://agentprime.io/advisories/CVE-2026-101013.md) `CVE-2026-101013` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project makeresult.php sql injection](https://agentprime.io/advisories/CVE-2026-101012.md) `CVE-2026-101012` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, SQL injection - [aaPanel BaoTa Domain domainMod.py get_domain_status sql injection](https://agentprime.io/advisories/CVE-2026-101011.md) `CVE-2026-101011` · CVE record: aaPanel BaoTa · CVSS 5.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, SQL injection - [aaPanel BaoTa data.py getData sql injection](https://agentprime.io/advisories/CVE-2026-101010.md) `CVE-2026-101010` · CVE record: aaPanel BaoTa · CVSS 5.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, SQL injection - [aaPanel BaoTa File Merge files.py merge_split_file command injection](https://agentprime.io/advisories/CVE-2026-101008.md) `CVE-2026-101008` · CVE record: aaPanel BaoTa · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, Command injection - [DevaslanPHP project-management Timesheet Dashboard MonthlyReport.php whereRaw sql injection](https://agentprime.io/advisories/CVE-2026-100899.md) `CVE-2026-100899` · CVE record: DevaslanPHP project-management · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, SQL injection - [DevaslanPHP project-management Timesheet Dashboard ActivitiesReport.php whereRaw sql injection](https://agentprime.io/advisories/CVE-2026-100898.md) `CVE-2026-100898` · CVE record: DevaslanPHP project-management · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection](https://agentprime.io/advisories/CVE-2026-100894.md) `CVE-2026-100894` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, SQL injection - [amirsanni Mini-Inventory-and-Sales-Management-System Database Query Builder DB_query_builder.php order_by sql injection](https://agentprime.io/advisories/CVE-2026-100887.md) `CVE-2026-100887` · CVE record: amirsanni Mini-Inventory-and-Sales-Management-System · CVSS 5.3 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php sql injection](https://agentprime.io/advisories/CVE-2026-100875.md) `CVE-2026-100875` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project addnewstudent.php sql injection](https://agentprime.io/advisories/CVE-2026-100874.md) `CVE-2026-100874` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project viewresult.php sql injection](https://agentprime.io/advisories/CVE-2026-100739.md) `CVE-2026-100739` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Other injection, SQL injection - [froxlor before 2.3.12 CRLF Injection via validateUrl userinfo](https://agentprime.io/advisories/CVE-2026-100717.md) `CVE-2026-100717` · CVE record: froxlor froxlor · CVSS 8.5 High · Not analysed yet · Published 26 Sept 2026 · Tags: Other injection - [Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection](https://agentprime.io/advisories/CVE-2026-100631.md) `CVE-2026-100631` · CVE record: parse-community parse-server · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Other injection - [mathurvishal CloudClassroom-PHP-Project mydetailsfaculty.php sql injection](https://agentprime.io/advisories/CVE-2026-100315.md) `CVE-2026-100315` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project updatedetailsfromstudent.php sql injection](https://agentprime.io/advisories/CVE-2026-100314.md) `CVE-2026-100314` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection](https://agentprime.io/advisories/CVE-2026-100312.md) `CVE-2026-100312` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Other injection, SQL injection - [OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export](https://agentprime.io/advisories/CVE-2026-100564.md) `CVE-2026-100564` · CVE record: OpenClaw OpenClaw · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Other injection - [OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels](https://agentprime.io/advisories/CVE-2026-100563.md) `CVE-2026-100563` · CVE record: OpenClaw OpenClaw · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Other injection - [GLPI: LDAP filter injection in user import feature](https://agentprime.io/advisories/CVE-2026-49469.md) `CVE-2026-49469` · CVE record: glpi-project glpi · CVSS 4.6 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection - [mathurvishal CloudClassroom-PHP-Project managevideos2.php sql injection](https://agentprime.io/advisories/CVE-2026-97886.md) `CVE-2026-97886` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection, SQL injection - [Networkmanager-vpnc: networkmanager-vpnc: incomplete fix for cve-2018-10900 allows root privilege escalation via ca-file path newline injection](https://agentprime.io/advisories/CVE-2026-91841.md) `CVE-2026-91841` · CVE record: GNOME NetworkManager-vpnc · CVSS 7.8 High · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection - [Networkmanager-vpnc: networkmanager-vpnc: local privilege escalation to root via newline injection in vpn username](https://agentprime.io/advisories/CVE-2026-91840.md) `CVE-2026-91840` · CVE record: GNOME NetworkManager-vpnc · CVSS 7.8 High · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection - [Networkmanager-fortisslvpn: networkmanager-fortisslvpn: local privilege escalation to root via crlf injection in vpn profile credentials](https://agentprime.io/advisories/CVE-2026-91839.md) `CVE-2026-91839` · CVE record: GNOME NetworkManager-fortisslvpn · CVSS 7.8 High · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection - [mathurvishal CloudClassroom-PHP-Project updatefaculty.php sql injection](https://agentprime.io/advisories/CVE-2026-97885.md) `CVE-2026-97885` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project Student Update Functionality updatestudent.php sql injection](https://agentprime.io/advisories/CVE-2026-97884.md) `CVE-2026-97884` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project updatequery.php sql injection](https://agentprime.io/advisories/CVE-2026-97883.md) `CVE-2026-97883` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project Faculty Authentication loginlinkfaculty.php sql injection](https://agentprime.io/advisories/CVE-2026-97882.md) `CVE-2026-97882` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection, SQL injection - [RabbitMQ: LDAP DN injection via unescaped substitution](https://agentprime.io/advisories/CVE-2026-67223.md) `CVE-2026-67223` · CVE record: rabbitmq rabbitmq-server · CVSS 6.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection - [Zhonglun CloudPos JSBridge JSBridge.cs OpenLocalBrowser code injection](https://agentprime.io/advisories/CVE-2026-97871.md) `CVE-2026-97871` · CVE record: Zhonglun CloudPos · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection, Code injection - [InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging](https://agentprime.io/advisories/CVE-2026-85290.md) `CVE-2026-85290` · CVE record: InvoicePlane InvoicePlane · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection - [Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell](https://agentprime.io/advisories/CVE-2026-95832.md) `CVE-2026-95832` · CVE record: Kovid Goyal kitty · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection - [Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup](https://agentprime.io/advisories/CVE-2026-97228.md) `CVE-2026-97228` · CVE record: Rapid7 Platform · CVSS 2.7 Low · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection - [zbateson/mail-mime-parser has CRLF header injection via attachment filename](https://agentprime.io/advisories/GHSA-36h5-qg4p-q2qf.md) `GHSA-36h5-qg4p-q2qf`, `CVE-2026-61815`, `PKSA-f3bq-hwxm-x4yf` · Packagist `zbateson/mail-mime-parser`: affected `<3.0.6 || >=4.0.0, <4.0.2`, fixed in `3.0.6`, `4.0.2` · CVSS 7.2 High · Not analysed yet · Published 24 Sept 2026 · Tags: Other injection - [Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context](https://agentprime.io/advisories/GHSA-g5f9-3xfg-p9mf.md) `GHSA-g5f9-3xfg-p9mf`, `CVE-2026-61732`, `PYSEC-2026-4032`, `PYSEC-2026-4033`, `PYSEC-2026-4034` · PyPI `decepticon` and 2 more: affected `<1.1.17`, fixed in `1.1.17` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Other injection - [YunaiV/zhijiantianya ruoyi-vue-pro GoView Data Endpoint GoViewDataServiceImpl.java GoViewDataServiceImpl.getDataBySQL sql injection](https://agentprime.io/advisories/CVE-2026-97321.md) `CVE-2026-97321` · CVE record: YunaiV ruoyi-vue-pro and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Other injection, SQL injection - [Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure](https://agentprime.io/advisories/CVE-2026-91133.md) `CVE-2026-91133` · CVE record: discourse discourse · CVSS 6.5 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Other injection - [Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel](https://agentprime.io/advisories/CVE-2026-96744.md) `CVE-2026-96744` · CVE record: MongoDB Laravel MongoDB (PHP) · CVSS 7.1 High · Not analysed yet · Published 24 Sept 2026 · Tags: Other injection - [DbGate JSON Runner runners.js code injection](https://agentprime.io/advisories/CVE-2026-97225.md) `CVE-2026-97225` · CVE record: DbGate · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Other injection, Code injection - [java110 MicroCommunity fallBack API Endpoint BusinessApi.java QueryServiceSMOImpl.fallBack sql injection](https://agentprime.io/advisories/CVE-2026-96803.md) `CVE-2026-96803` · CVE record: java110 MicroCommunity · CVSS 6.9 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Other injection, SQL injection - [Forma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injection](https://agentprime.io/advisories/CVE-2026-96777.md) `CVE-2026-96777` · CVE record: Forma LMS · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Other injection, SQL injection - [pmTicket Project-Management-Software add_project.php setSync sql injection](https://agentprime.io/advisories/CVE-2026-96751.md) `CVE-2026-96751` · CVE record: pmTicket Project-Management-Software · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection - [SoftNews Media Group DataLife Engine Search search.php strip_data sql injection](https://agentprime.io/advisories/CVE-2026-96604.md) `CVE-2026-96604` · CVE record: SoftNews Media Group DataLife Engine · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection - [Abdurrab5 online-makeup-store Customer Login customerSignin.php sql injection](https://agentprime.io/advisories/CVE-2026-96602.md) `CVE-2026-96602` · CVE record: Abdurrab5 online-makeup-store · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection - [Abdurrab5 online-makeup-store Admin Login index.php sql injection](https://agentprime.io/advisories/CVE-2026-96601.md) `CVE-2026-96601` · CVE record: Abdurrab5 online-makeup-store · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection - [Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint](https://agentprime.io/advisories/GHSA-g7f6-rxc4-qhph.md) `GHSA-g7f6-rxc4-qhph`, `CVE-2026-93421`, `PYSEC-2026-4105` · PyPI `mesop`: affected `<1.3.4`, fixed in `1.3.4` · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, CWE-150 - [Neethuharii CafeManagement Login CafePortalLogin.php sql injection](https://agentprime.io/advisories/CVE-2026-96514.md) `CVE-2026-96514` · CVE record: Neethuharii CafeManagement · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection - [Multiple Vulnerabilities in IBM Concert Software](https://agentprime.io/advisories/CVE-2026-6327.md) `CVE-2026-6327` · CVE record: IBM Concert · CVSS 4.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection - [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-19179.md) `CVE-2026-19179` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 8.2 High · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection - [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-18875.md) `CVE-2026-18875` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 7.3 High · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection - [XML Injection vulnerability](https://agentprime.io/advisories/CVE-2026-76979.md) `CVE-2026-76979` · CVE record: Zohocorp ManageEngine OpManager and 1 more · CVSS 7.7 High · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection - [Ninja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Data Source](https://agentprime.io/advisories/CVE-2026-86612.md) `CVE-2026-86612` · CVE record: Unknown Ninja Tables · CVSS 5.6 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection - [GTranslate < 5.0.1 - Unauthenticated Arbitrary Shortcode Execution via Email Translation](https://agentprime.io/advisories/CVE-2026-86604.md) `CVE-2026-86604` · CVE record: Unknown GTranslate · CVSS 4.8 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection - [WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Content](https://agentprime.io/advisories/CVE-2026-86601.md) `CVE-2026-86601` · CVE record: Unknown WP Recipe Maker · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .