# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection](https://agentprime.io/advisories/CVE-2026-3395.md) `CVE-2026-3395` · CVE record: MaxSite CMS · CVSS 6.9 Medium · Not analysed yet · Published 1 Mar 2026 · Tags: Other injection, Code injection - [OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth)](https://agentprime.io/advisories/GHSA-82g8-464f-2mv7.md) `GHSA-82g8-464f-2mv7`, `CVE-2026-4039` · npm `openclaw`: affected `<2026.2.21`, fixed in `2026.2.21` · CVSS 5.3 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Other injection, Code injection, CWE-15, CWE-1341 - [calibre Vulnerable to HTTP Response Header Injection](https://agentprime.io/advisories/CVE-2026-27810.md) `CVE-2026-27810` · CVE record: kovidgoyal calibre · CVSS 6.4 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Other injection - [jizhiCMS Batch Model.php findAll sql injection](https://agentprime.io/advisories/CVE-2026-3292.md) `CVE-2026-3292` · CVE record: jizhiCMS · CVSS 5.3 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Other injection, SQL injection - [youlaitech youlai-mall App-side Product Pagination Endpoint SpuController.java listPagedSpuForApp sql injection](https://agentprime.io/advisories/CVE-2026-3287.md) `CVE-2026-3287` · CVE record: youlaitech youlai-mall · CVSS 5.3 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Other injection, SQL injection - [Koa has Host Header Injection via ctx.hostname](https://agentprime.io/advisories/GHSA-7gcc-r8m5-44qm.md) `GHSA-7gcc-r8m5-44qm`, `CVE-2026-27959` · npm `koa`: affected `<2.16.4 || >=3.0.0, <3.1.2`, fixed in `2.16.4`, `3.1.2` · CVSS 7.5 High · Not analysed yet · Published 26 Feb 2026 · Tags: Other injection, CWE-20 - [Arbitrary code execution in log reader via untrusted log file](https://agentprime.io/advisories/CVE-2026-28211.md) `CVE-2026-28211` · CVE record: CyrilleB79 NVDA-Dev-Test-Toolbox · CVSS 7.8 High · Not analysed yet · Published 26 Feb 2026 · Tags: Other injection - [itsourcecode School Management System Setting index.php sql injection](https://agentprime.io/advisories/CVE-2026-3261.md) `CVE-2026-3261` · CVE record: itsourcecode School Management System · CVSS 6.9 Medium · Not analysed yet · Published 26 Feb 2026 · Tags: Other injection, SQL injection - [Storybook Dev Server is Vulnerable to WebSocket Hijacking](https://agentprime.io/advisories/GHSA-mjf5-7g4m-gx5w.md) `GHSA-mjf5-7g4m-gx5w`, `CVE-2026-27148` · npm `storybook`: affected `>=8.1.0, <8.6.17 || >=8.7.0-alpha.0, <9.1.19 || >=10.0.0-beta.0, <10.2.10`, fixed in `8.6.17`, `9.1.19`, `10.2.10` · CVSS 8.9 High · Not analysed yet · Published 26 Feb 2026 · Tags: Other injection, Cross-site scripting (XSS), CWE-346, CWE-1385 - [Gvfs: ftp gvfs backend: arbitrary ftp command injection via crlf sequences in file paths](https://agentprime.io/advisories/CVE-2026-28296.md) `CVE-2026-28296` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 26 Feb 2026 · Tags: Other injection - [z-9527 admin user.js getUsers sql injection](https://agentprime.io/advisories/CVE-2026-3200.md) `CVE-2026-3200` · CVE record: z-9527 admin · CVSS 6.9 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Other injection, SQL injection - [mchange-commons-java: Remote Code Execution via JNDI Reference Resolution](https://agentprime.io/advisories/GHSA-m2cm-222f-qw44.md) `GHSA-m2cm-222f-qw44`, `CVE-2026-27727` · Maven `com.mchange:mchange-commons-java`: affected `<0.4.0`, fixed in `0.4.0` · CVSS 8.9 High · Not analysed yet · Published 25 Feb 2026 · Tags: Other injection, Insecure deserialization - [itsourcecode News Portal Project contactus.php sql injection](https://agentprime.io/advisories/CVE-2026-3164.md) `CVE-2026-3164` · CVE record: itsourcecode News Portal Project · CVSS 6.9 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Other injection, SQL injection - [itsourcecode Document Management System register.php sql injection](https://agentprime.io/advisories/CVE-2026-3153.md) `CVE-2026-3153` · CVE record: itsourcecode Document Management System · CVSS 6.9 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Other injection, SQL injection - [itsourcecode College Management System teacher-salary.php sql injection](https://agentprime.io/advisories/CVE-2026-3152.md) `CVE-2026-3152` · CVE record: itsourcecode College Management System · CVSS 6.9 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Other injection, SQL injection - [itsourcecode College Management System login.php sql injection](https://agentprime.io/advisories/CVE-2026-3151.md) `CVE-2026-3151` · CVE record: itsourcecode College Management System · CVSS 6.9 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Other injection, SQL injection - [itsourcecode College Management System display-teacher.php sql injection](https://agentprime.io/advisories/CVE-2026-3150.md) `CVE-2026-3150` · CVE record: itsourcecode College Management System · CVSS 5.3 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Other injection, SQL injection - [itsourcecode College Management System asign-single-student-subjects.php sql injection](https://agentprime.io/advisories/CVE-2026-3149.md) `CVE-2026-3149` · CVE record: itsourcecode College Management System · CVSS 5.3 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Other injection, SQL injection - [SourceCodester Simple and Nice Shopping Cart Script signup.php sql injection](https://agentprime.io/advisories/CVE-2026-3148.md) `CVE-2026-3148` · CVE record: SourceCodester Simple and Nice Shopping Cart Script · CVSS 6.9 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Other injection, SQL injection - [itsourcecode News Portal Project add-category.php sql injection](https://agentprime.io/advisories/CVE-2026-3135.md) `CVE-2026-3135` · CVE record: itsourcecode News Portal Project · CVSS 6.9 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Other injection, SQL injection - [itsourcecode News Portal Project edit-category.php sql injection](https://agentprime.io/advisories/CVE-2026-3134.md) `CVE-2026-3134` · CVE record: itsourcecode News Portal Project · CVSS 6.9 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Other injection, SQL injection - [itsourcecode Document Management System Login loging.php sql injection](https://agentprime.io/advisories/CVE-2026-3133.md) `CVE-2026-3133` · CVE record: itsourcecode Document Management System · CVSS 6.9 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Other injection, SQL injection - [itsourcecode Document Management System edtlbls.php sql injection](https://agentprime.io/advisories/CVE-2026-3069.md) `CVE-2026-3069` · CVE record: itsourcecode Document Management System · CVSS 6.9 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Other injection, SQL injection - [itsourcecode Document Management System deluser.php sql injection](https://agentprime.io/advisories/CVE-2026-3068.md) `CVE-2026-3068` · CVE record: itsourcecode Document Management System · CVSS 6.9 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Other injection, SQL injection - [HummerRisk Cloud Compliance Scanning PlatformUtils.java fixedCommand command injection](https://agentprime.io/advisories/CVE-2026-3066.md) `CVE-2026-3066` · CVE record: HummerRisk · CVSS 5.3 Medium · EPSS 0.13 · Not analysed yet · Published 24 Feb 2026 · Tags: Other injection, Command injection - [HummerRisk Cloud Task Dry-run CloudTaskService.java CommandUtils.commonExecCmdWithResult command injection](https://agentprime.io/advisories/CVE-2026-3065.md) `CVE-2026-3065` · CVE record: HummerRisk · CVSS 5.3 Medium · EPSS 0.33 · Not analysed yet · Published 24 Feb 2026 · Tags: Other injection, Command injection - [HummerRisk Cloud Task Scheduler ResourceCreateService.java command injection](https://agentprime.io/advisories/CVE-2026-3064.md) `CVE-2026-3064` · CVE record: HummerRisk · CVSS 5.3 Medium · EPSS 0.22 · Not analysed yet · Published 24 Feb 2026 · Tags: Other injection, Command injection - [a54552239 pearProjectApi Backend Task.php dateTotalForProject sql injection](https://agentprime.io/advisories/CVE-2026-3057.md) `CVE-2026-3057` · CVE record: a54552239 pearProjectApi · CVSS 5.3 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Other injection, SQL injection - [itsourcecode E-Logbook with Health Monitoring System for COVID-19 check_profile_old.php sql injection](https://agentprime.io/advisories/CVE-2026-3046.md) `CVE-2026-3046` · CVE record: itsourcecode E-Logbook with Health Monitoring System for COVID-19 · CVSS 6.9 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Other injection, SQL injection - [itsourcecode Event Management System index.php sql injection](https://agentprime.io/advisories/CVE-2026-3042.md) `CVE-2026-3042` · CVE record: itsourcecode Event Management System · CVSS 6.9 Medium · Not analysed yet · Published 23 Feb 2026 · Tags: Other injection, SQL injection - [New API has an SQL LIKE Wildcard Injection DoS via Token Search](https://agentprime.io/advisories/GHSA-w6x6-9fp7-fqm4.md) `GHSA-w6x6-9fp7-fqm4`, `CVE-2026-25591`, `GO-2026-4531` · Go `github.com/QuantumNous/new-api`: affected `<0.10.8-alpha.10`, fixed in `0.10.8-alpha.10` · CVSS 7.1 High · Not analysed yet · Published 23 Feb 2026 · Tags: Other injection - [Valkey Affected by RESP Protocol Injection via Lua error_reply](https://agentprime.io/advisories/CVE-2025-67733.md) `CVE-2025-67733` · CVE record: valkey-io valkey · CVSS 8.5 High · Not analysed yet · Published 23 Feb 2026 · Tags: Other injection, CWE-170 - [Jinher OA C6 OfficeSupplyTypeRight.aspx sql injection](https://agentprime.io/advisories/CVE-2026-2963.md) `CVE-2026-2963` · CVE record: Jinher OA C6 · CVSS 5.3 Medium · Not analysed yet · Published 23 Feb 2026 · Tags: Other injection, SQL injection - [qinming99 dst-admin restore revertBackup command injection](https://agentprime.io/advisories/CVE-2026-2956.md) `CVE-2026-2956` · CVE record: qinming99 dst-admin · CVSS 5.3 Medium · Not analysed yet · Published 22 Feb 2026 · Tags: Other injection, Command injection - [Dromara UJCMS ImportDataController import-channel importChanel injection](https://agentprime.io/advisories/CVE-2026-2954.md) `CVE-2026-2954` · CVE record: Dromara UJCMS · CVSS 5.3 Medium · Not analysed yet · Published 22 Feb 2026 · Tags: Other injection, CWE-707 - [code-projects Online Reviewer System studentresult-view.php sql injection](https://agentprime.io/advisories/CVE-2026-2912.md) `CVE-2026-2912` · CVE record: code-projects Online Reviewer System · CVSS 6.9 Medium · Not analysed yet · Published 22 Feb 2026 · Tags: Other injection, SQL injection - [itsourcecode Vehicle Management System billaction.php sql injection](https://agentprime.io/advisories/CVE-2026-2867.md) `CVE-2026-2867` · CVE record: itsourcecode Vehicle Management System · CVSS 6.9 Medium · Not analysed yet · Published 21 Feb 2026 · Tags: Other injection, SQL injection - [itsourcecode Agri-Trading Online Shopping System HTTP POST Request productcontroller.php sql injection](https://agentprime.io/advisories/CVE-2026-2865.md) `CVE-2026-2865` · CVE record: itsourcecode Agri-Trading Online Shopping System · CVSS 6.9 Medium · Not analysed yet · Published 21 Feb 2026 · Tags: Other injection, SQL injection - [SourceCodester Simple Responsive Tourism Website Registration Master.php sql injection](https://agentprime.io/advisories/CVE-2026-2848.md) `CVE-2026-2848` · CVE record: SourceCodester Simple Responsive Tourism Website · CVSS 6.9 Medium · Not analysed yet · Published 20 Feb 2026 · Tags: Other injection, SQL injection - [Comfast CF-E7 webmggnt mbox-config sub_441CF4 command injection](https://agentprime.io/advisories/CVE-2026-2824.md) `CVE-2026-2824` · CVE record: Comfast CF-E7 · CVSS 5.3 Medium · EPSS 0.17 · Not analysed yet · Published 20 Feb 2026 · Tags: Other injection, Command injection - [Comfast CF-E7 webmggnt mbox-config sub_41ACCC command injection](https://agentprime.io/advisories/CVE-2026-2823.md) `CVE-2026-2823` · CVE record: Comfast CF-E7 · CVSS 5.3 Medium · EPSS 0.19 · Not analysed yet · Published 20 Feb 2026 · Tags: Other injection, Command injection - [JeecgBoot Backend airag_app,1,create_by sql injection](https://agentprime.io/advisories/CVE-2026-2822.md) `CVE-2026-2822` · CVE record: JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 20 Feb 2026 · Tags: Other injection, SQL injection - [Fujian Smart Integrated Management Platform System XCamera.ashx sql injection](https://agentprime.io/advisories/CVE-2026-2821.md) `CVE-2026-2821` · CVE record: Fujian Smart Integrated Management Platform System · CVSS 6.9 Medium · Not analysed yet · Published 20 Feb 2026 · Tags: Other injection, SQL injection - [Fujian Smart Integrated Management Platform System XAccessPermissionPlus.ashx sql injection](https://agentprime.io/advisories/CVE-2026-2820.md) `CVE-2026-2820` · CVE record: Fujian Smart Integrated Management Platform System · CVSS 6.9 Medium · Not analysed yet · Published 20 Feb 2026 · Tags: Other injection, SQL injection - [D-Tale affected by Remote Code Execution through the /save-column-filter endpoint](https://agentprime.io/advisories/GHSA-c87c-78rc-vmv2.md) `GHSA-c87c-78rc-vmv2`, `CVE-2026-27194`, `PYSEC-2026-2461` · PyPI `dtale`: affected `<3.20.0`, fixed in `3.20.0` · CVSS 8.1 High · Not analysed yet · Published 19 Feb 2026 · Tags: Other injection - [eBay API MCP Server Affected by Environment Variable Injection](https://agentprime.io/advisories/GHSA-97rm-xj73-33jh.md) `GHSA-97rm-xj73-33jh`, `CVE-2026-27203` · npm `ebay-mcp`: affected `<=1.7.2`, no fixed version yet · CVSS 8.3 High · Not analysed yet · Published 19 Feb 2026 · Tags: Other injection, CWE-15 - [code-projects Patient Record Management System fecalysis_not.php sql injection](https://agentprime.io/advisories/CVE-2026-2706.md) `CVE-2026-2706` · CVE record: code-projects Patient Record Management System · CVSS 5.3 Medium · Not analysed yet · Published 19 Feb 2026 · Tags: Other injection, SQL injection - [itsourcecode Event Management System manage_register.php sql injection](https://agentprime.io/advisories/CVE-2026-2691.md) `CVE-2026-2691` · CVE record: itsourcecode Event Management System · CVSS 6.9 Medium · Not analysed yet · Published 19 Feb 2026 · Tags: Other injection, SQL injection - [itsourcecode Event Management System Admin Login ajax.php sql injection](https://agentprime.io/advisories/CVE-2026-2690.md) `CVE-2026-2690` · CVE record: itsourcecode Event Management System · CVSS 6.9 Medium · Not analysed yet · Published 19 Feb 2026 · Tags: Other injection, SQL injection - [itsourcecode Event Management System manage_booking.php sql injection](https://agentprime.io/advisories/CVE-2026-2689.md) `CVE-2026-2689` · CVE record: itsourcecode Event Management System · CVSS 6.9 Medium · Not analysed yet · Published 19 Feb 2026 · Tags: Other injection, SQL injection - [InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning](https://agentprime.io/advisories/CVE-2026-25548.md) `CVE-2026-25548` · CVE record: InvoicePlane InvoicePlane · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Feb 2026 · Tags: Code injection, File inclusion, Other injection - [RediSearch Query Injection in @langchain/langgraph-checkpoint-redis](https://agentprime.io/advisories/GHSA-5mx2-w598-339m.md) `GHSA-5mx2-w598-339m`, `CVE-2026-27022` · npm `@langchain/langgraph-checkpoint-redis`: affected `<1.0.2`, fixed in `1.0.2` · CVSS 6.5 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Other injection - [Tsinghua Unigroup Electronic Archives System prinReport.html sql injection](https://agentprime.io/advisories/CVE-2026-2682.md) `CVE-2026-2682` · CVE record: Tsinghua Unigroup Electronic Archives System · CVSS 5.3 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Other injection, SQL injection - [Alixhan xh-admin-backend Database Query query sql injection](https://agentprime.io/advisories/CVE-2026-2663.md) `CVE-2026-2663` · CVE record: Alixhan xh-admin-backend · CVSS 5.3 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Other injection, SQL injection - [Cart All In One For WooCommerce <= 1.1.21 - Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting](https://agentprime.io/advisories/CVE-2026-2019.md) `CVE-2026-2019` · CVE record: villatheme Cart All In One For WooCommerce · CVSS 7.2 High · Not analysed yet · Published 18 Feb 2026 · Tags: Other injection - [ShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action](https://agentprime.io/advisories/CVE-2026-1714.md) `CVE-2026-1714` · CVE record: devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin · CVSS 8.6 High · Not analysed yet · Published 18 Feb 2026 · Tags: Other injection - [OpenClaw log poisoning (indirect prompt injection) via WebSocket headers](https://agentprime.io/advisories/GHSA-g27f-9qjv-22pm.md) `GHSA-g27f-9qjv-22pm` · npm `openclaw`: affected `<2026.2.13`, fixed in `2026.2.13` · CVSS 3.1 Low · Not analysed yet · Published 17 Feb 2026 · Tags: Other injection - [Sciyon Koyuan Thermoelectricity Heat Network Management System AsyncTreeProxy.aspx sql injection](https://agentprime.io/advisories/CVE-2026-2621.md) `CVE-2026-2621` · CVE record: Sciyon Koyuan Thermoelectricity Heat Network Management System · CVSS 6.9 Medium · Not analysed yet · Published 17 Feb 2026 · Tags: Other injection, SQL injection - [Huace Monitoring and Early Warning System ProjectRole.aspx sql injection](https://agentprime.io/advisories/CVE-2026-2620.md) `CVE-2026-2620` · CVE record: Huace Monitoring and Early Warning System · CVSS 6.9 Medium · Not analysed yet · Published 17 Feb 2026 · Tags: Other injection, SQL injection - [Multiple vulnerabilities in IBM MQ Operator and Queue manager container images](https://agentprime.io/advisories/CVE-2025-12755.md) `CVE-2025-12755` · CVE record: IBM MQ Operator and 1 more · CVSS 4.0 Medium · Not analysed yet · Published 17 Feb 2026 · Tags: Other injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .