# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [iFlytek astron-agent getBotList API endpoint ChatBotMarketMapper.xml sql injection](https://agentprime.io/advisories/CVE-2026-95929.md) `CVE-2026-95929` · CVE record: iFlytek astron-agent · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Reviewer Management System exam-delete.php sql injection](https://agentprime.io/advisories/CVE-2026-95927.md) `CVE-2026-95927` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Reviewer Management System btn_functions.php update sql injection](https://agentprime.io/advisories/CVE-2026-95926.md) `CVE-2026-95926` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Reviewer Management System btn_functions.php update sql injection](https://agentprime.io/advisories/CVE-2026-95925.md) `CVE-2026-95925` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Reviewer Management System btn_functions.php add sql injection](https://agentprime.io/advisories/CVE-2026-95924.md) `CVE-2026-95924` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection - [AdithyaYelloju Restaurant-Management-System Search Form display_menu.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-95868.md) `CVE-2026-95868` · CVE record: AdithyaYelloju Restaurant-Management-System · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Leave Management System index.php sql injection](https://agentprime.io/advisories/CVE-2026-95833.md) `CVE-2026-95833` · CVE record: itsourcecode Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Other injection, SQL injection - [TDuckCloud tduck-platform Pagination Inner Interceptor MybatisPlusConfig.java PaginationInnerInterceptor.concatOrderBy sql injection](https://agentprime.io/advisories/CVE-2026-95829.md) `CVE-2026-95829` · CVE record: TDuckCloud tduck-platform · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Other injection, SQL injection - [anirbandutta9 College-Notes-Gallery login.php sql injection](https://agentprime.io/advisories/CVE-2026-95819.md) `CVE-2026-95819` · CVE record: anirbandutta9 College-Notes-Gallery · CVSS 6.9 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Other injection, SQL injection - [MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths](https://agentprime.io/advisories/CVE-2026-95806.md) `CVE-2026-95806` · CVE record: MISP MISP · CVSS 7.7 High · Not analysed yet · Published 22 Sept 2026 · Tags: Other injection, Insecure deserialization - [mtrano APENCMS Template weasel.php eval code injection](https://agentprime.io/advisories/CVE-2026-95501.md) `CVE-2026-95501` · CVE record: mtrano APENCMS · CVSS 4.8 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Other injection, Code injection - [XML injection in NVIDIA Infrastructure Controller](https://agentprime.io/advisories/CVE-2026-65124.md) `CVE-2026-65124` · CVE record: NVIDIA Infrastructure Controller · CVSS 5.9 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Other injection - [Livestatus injection via monitoring filter values](https://agentprime.io/advisories/CVE-2026-90990.md) `CVE-2026-90990` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Other injection - [Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array](https://agentprime.io/advisories/CVE-2026-93711.md) `CVE-2026-93711` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Other injection - [Yonyou U8cloud OpenAPI so.saleorder.sendaudit sql injection](https://agentprime.io/advisories/CVE-2026-94492.md) `CVE-2026-94492` · CVE record: Yonyou U8cloud · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Other injection, SQL injection - [Yonyou KSOA search_list.jsp sql injection](https://agentprime.io/advisories/CVE-2026-94491.md) `CVE-2026-94491` · CVE record: Yonyou KSOA · CVSS 6.9 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Other injection, SQL injection - [luci-app-adblock-fast: Delegated \`luci-app-adblock-fast\` users can reach root command execution by injecting newline-separated cron entries](https://agentprime.io/advisories/CVE-2026-55159.md) `CVE-2026-55159` · CVE record: openwrt luci-app-adblock-fast · CVSS 8.8 High · Not analysed yet · Published 21 Sept 2026 · Tags: Other injection - [ST Engineering iDirect iDX/Evo iDX HTTP Request authorize response splitting](https://agentprime.io/advisories/CVE-2026-94216.md) `CVE-2026-94216` · CVE record: ST Engineering iDirect iDX and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Other injection - [GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name](https://agentprime.io/advisories/CVE-2026-85113.md) `CVE-2026-85113` · CVE record: Unknown GiveWP · CVSS 6.5 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Other injection - [drogonframework drogon ORM Criteria.cc makeCriteria sql injection](https://agentprime.io/advisories/CVE-2026-94144.md) `CVE-2026-94144` · CVE record: drogonframework drogon · CVSS 6.9 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Other injection, SQL injection - [drogonframework drogon ORM Mapper Mapper.h orderBy sql injection](https://agentprime.io/advisories/CVE-2026-94143.md) `CVE-2026-94143` · CVE record: drogonframework drogon · CVSS 6.9 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Other injection, SQL injection - [Chengdu Feiyuxing Technology Feiyu Star Router Cookie send_order.cgi command injection](https://agentprime.io/advisories/CVE-2026-94139.md) `CVE-2026-94139` · CVE record: Chengdu Feiyuxing Technology Feiyu Star Router · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Other injection, Command injection - [Chengdu Feiyuxing Technology Feiyu Star Router send_order.cgi command injection](https://agentprime.io/advisories/CVE-2026-94138.md) `CVE-2026-94138` · CVE record: Chengdu Feiyuxing Technology Feiyu Star Router · CVSS 5.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Other injection, Command injection - [QCMS Content Detail Controllers.php self_Tmp sql injection](https://agentprime.io/advisories/CVE-2026-94110.md) `CVE-2026-94110` · CVE record: QCMS · CVSS 6.9 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Other injection, SQL injection - [RooCMS Frontend Rendering site_pagePHP.php eval code injection](https://agentprime.io/advisories/CVE-2026-94103.md) `CVE-2026-94103` · CVE record: RooCMS · CVSS 5.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Other injection, Code injection - [Netcore NBR200V2 Backup Restore restore.cgi command injection](https://agentprime.io/advisories/CVE-2026-94099.md) `CVE-2026-94099` · CVE record: Netcore NBR200V2 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Other injection, Command injection - [Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection](https://agentprime.io/advisories/CVE-2026-94098.md) `CVE-2026-94098` · CVE record: Netcore NBR200V2 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Other injection, Command injection - [Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injection](https://agentprime.io/advisories/CVE-2026-94097.md) `CVE-2026-94097` · CVE record: Netcore NBR200V2 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, Command injection - [Netcore NBR200V2 LAN IP Configuration network_tools command injection](https://agentprime.io/advisories/CVE-2026-94096.md) `CVE-2026-94096` · CVE record: Netcore NBR200V2 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, Command injection - [Netcore NBR200V2 Traceroute Diagnostic Feature network_tools command injection](https://agentprime.io/advisories/CVE-2026-94095.md) `CVE-2026-94095` · CVE record: Netcore NBR200V2 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, Command injection - [AdithyaYelloju Restaurant Management System add_table.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-94042.md) `CVE-2026-94042` · CVE record: AdithyaYelloju Restaurant Management System · CVSS 5.3 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [AdithyaYelloju Restaurant-Management-System add_menu.php sql injection](https://agentprime.io/advisories/CVE-2026-94041.md) `CVE-2026-94041` · CVE record: AdithyaYelloju Restaurant-Management-System · CVSS 5.3 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Leave Management System index.php sql injection](https://agentprime.io/advisories/CVE-2026-94032.md) `CVE-2026-94032` · CVE record: itsourcecode Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [0-Gaurav-0 nexus-mcp nexus_reauth MCP tool browser.ts child_process.exec command injection](https://agentprime.io/advisories/CVE-2026-94031.md) `CVE-2026-94031` · CVE record: 0-Gaurav-0 nexus-mcp · CVSS 5.3 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, Command injection - [SourceCodester Drug Recommendation System edit_user.php sql injection](https://agentprime.io/advisories/CVE-2026-94015.md) `CVE-2026-94015` · CVE record: SourceCodester Drug Recommendation System · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [DedeCMS mytag_js.php code injection](https://agentprime.io/advisories/CVE-2026-94004.md) `CVE-2026-94004` · CVE record: DedeCMS · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, Code injection - [SourceCodester Drug Recommendation System edit_symptom.php sql injection](https://agentprime.io/advisories/CVE-2026-93997.md) `CVE-2026-93997` · CVE record: SourceCodester Drug Recommendation System · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [code-projects Internship Management System Admin Login Form login.php sql injection](https://agentprime.io/advisories/CVE-2026-93980.md) `CVE-2026-93980` · CVE record: code-projects Internship Management System · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [code-projects Internship Management System login.php sql injection](https://agentprime.io/advisories/CVE-2026-93979.md) `CVE-2026-93979` · CVE record: code-projects Internship Management System · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [code-projects Internship Management System login.php sql injection](https://agentprime.io/advisories/CVE-2026-93978.md) `CVE-2026-93978` · CVE record: code-projects Internship Management System · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Reviewer Management System btn_functions.php remove sql injection](https://agentprime.io/advisories/CVE-2026-93974.md) `CVE-2026-93974` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Reviewer Management System btn_functions.php remove sql injection](https://agentprime.io/advisories/CVE-2026-93973.md) `CVE-2026-93973` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Reviewer Management System btn_functions.php sql injection](https://agentprime.io/advisories/CVE-2026-93972.md) `CVE-2026-93972` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [aiyiyi121 SxDevOps Command services.py generate_host_task command injection](https://agentprime.io/advisories/CVE-2026-93967.md) `CVE-2026-93967` · CVE record: aiyiyi121 SxDevOps · CVSS 5.1 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, Command injection - [aiyiyi121 SxDevOps TASK_RUN_COMMAND host_tasks.py paramiko.SSHClient.exec_command command injection](https://agentprime.io/advisories/CVE-2026-93966.md) `CVE-2026-93966` · CVE record: aiyiyi121 SxDevOps · CVSS 5.1 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, Command injection - [aiyiyi121 SxDevOps MCP STDIO Server Management services.py subprocess.Popen command injection](https://agentprime.io/advisories/CVE-2026-93965.md) `CVE-2026-93965` · CVE record: aiyiyi121 SxDevOps · CVSS 5.1 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, Command injection - [itsourcecode Leave Management System controller.php sql injection](https://agentprime.io/advisories/CVE-2026-93963.md) `CVE-2026-93963` · CVE record: itsourcecode Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Reviewer Management System btn_functions.php sql injection](https://agentprime.io/advisories/CVE-2026-93959.md) `CVE-2026-93959` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [CRLF injection in Exim](https://agentprime.io/advisories/CVE-2026-94057.md) `CVE-2026-94057` · CVE record: Exim Exim · CVSS 4.0 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Other injection - [Totolink A3002MU formWsc command injection](https://agentprime.io/advisories/CVE-2026-93742.md) `CVE-2026-93742` · CVE record: Totolink A3002MU · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Sept 2026 · Tags: Other injection, Command injection - [WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection](https://agentprime.io/advisories/CVE-2026-87909.md) `CVE-2026-87909` · CVE record: opajaap WP Photo Album Plus · CVSS 7.5 High · Not analysed yet · Published 19 Sept 2026 · Tags: Other injection - [IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-11538.md) `CVE-2026-11538` · CVE record: IBM WebSphere Application Server · CVSS 3.7 Low · Not analysed yet · Published 18 Sept 2026 · Tags: Other injection - [NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard](https://agentprime.io/advisories/CVE-2026-93760.md) `CVE-2026-93760` · CVE record: MongoDB Inc. Mongoid · CVSS 8.3 High · Not analysed yet · Published 18 Sept 2026 · Tags: Other injection - [Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419)](https://agentprime.io/advisories/CVE-2026-93576.md) `CVE-2026-93576` · CVE record: Red Hat Red Hat build of Apache Camel for Spring Boot 4 and 3 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: Other injection - [CRLF injection in Synology DiskStation Manager (DSM)](https://agentprime.io/advisories/CVE-2026-40530.md) `CVE-2026-40530` · CVE record: Synology DiskStation Manager (DSM) · CVSS 8.0 High · Not analysed yet · Published 18 Sept 2026 · Tags: Other injection - [CRLF injection in Synology DiskStation Manager (DSM)](https://agentprime.io/advisories/CVE-2026-13666.md) `CVE-2026-13666` · CVE record: Synology DiskStation Manager (DSM) · CVSS 3.5 Low · Not analysed yet · Published 18 Sept 2026 · Tags: Other injection - [marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection](https://agentprime.io/advisories/CVE-2026-93371.md) `CVE-2026-93371` · CVE record: marcopiovanello yt-dlp-web-ui · CVSS 6.9 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Other injection, Command injection - [Azure Cosmos DB Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-87701.md) `CVE-2026-87701` · CVE record: Microsoft Azure Cosmos DB · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Other injection - [code-projects Matrimonial System partner_preference.php writepartnerprefs sql injection](https://agentprime.io/advisories/CVE-2026-92926.md) `CVE-2026-92926` · CVE record: code-projects Matrimonial System · CVSS 6.9 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Other injection, SQL injection - [MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution](https://agentprime.io/advisories/CVE-2026-93295.md) `CVE-2026-93295` · CVE record: misp misp · CVSS 8.7 High · Not analysed yet · Published 17 Sept 2026 · Tags: Other injection, CWE-20 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .