# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [itsourcecode Online Enrollment System login.php sql injection](https://agentprime.io/advisories/CVE-2026-4235.md) `CVE-2026-4235` · CVE record: itsourcecode Online Enrollment System · CVSS 6.9 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection, SQL injection - [SSCMS DDL SitesAddController.Submit.cs sql injection](https://agentprime.io/advisories/CVE-2026-4234.md) `CVE-2026-4234` · CVE record: SSCMS · CVSS 5.3 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection, SQL injection - [Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma application web](https://agentprime.io/advisories/CVE-2026-3023.md) `CVE-2026-3023` · CVE record: Wakyma Wakyma application web · CVSS 5.3 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection - [Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma application web](https://agentprime.io/advisories/CVE-2026-3022.md) `CVE-2026-3022` · CVE record: Wakyma Wakyma application web · CVSS 7.1 High · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection - [Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma application web](https://agentprime.io/advisories/CVE-2026-3021.md) `CVE-2026-3021` · CVE record: Wakyma Wakyma application web · CVSS 7.1 High · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection - [Tiandy Integrated Management Platform getAuthorityByUserId sql injection](https://agentprime.io/advisories/CVE-2026-4232.md) `CVE-2026-4232` · CVE record: Tiandy Integrated Management Platform · CVSS 6.9 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection, SQL injection - [vanna-ai vanna Endpoint \_\_init\_\_.py update_sql sql injection](https://agentprime.io/advisories/CVE-2026-4230.md) `CVE-2026-4230` · CVE record: vanna-ai vanna · CVSS 5.3 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection, SQL injection - [LB-LINK BL-WR9000 set_wifi sub_458754 command injection](https://agentprime.io/advisories/CVE-2026-4228.md) `CVE-2026-4228` · CVE record: LB-LINK BL-WR9000 · CVSS 5.3 Medium · EPSS 0.14 · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection, Command injection - [itsourcecode Payroll Management System manage_employee.php sql injection](https://agentprime.io/advisories/CVE-2026-4223.md) `CVE-2026-4223` · CVE record: itsourcecode Payroll Management System · CVSS 6.9 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection, SQL injection - [D-Link DNS-1550-04 time_machine.cgi cgi_tm_set_share command injection](https://agentprime.io/advisories/CVE-2026-4210.md) `CVE-2026-4210` · CVE record: D-Link DNS-120 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection, Command injection - [D-Link DNS-1550-04 account_mgr.cgi cgi_chg_admin_pw command injection](https://agentprime.io/advisories/CVE-2026-4209.md) `CVE-2026-4209` · CVE record: D-Link DNS-120 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection, Command injection - [D-Link DNS-1550-04 system_mgr.cgi cgi_ntp_time command injection](https://agentprime.io/advisories/CVE-2026-4207.md) `CVE-2026-4207` · CVE record: D-Link DNS-120 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection, Command injection - [D-Link DNS-1550-04 dsk_mgr.cgi ScanDisk_run_e2fsck command injection](https://agentprime.io/advisories/CVE-2026-4206.md) `CVE-2026-4206` · CVE record: D-Link DNS-120 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection, Command injection - [D-Link DNS-1550-04 app_mgr.cgi FTP_Server_BlockIP_Del command injection](https://agentprime.io/advisories/CVE-2026-4205.md) `CVE-2026-4205` · CVE record: D-Link DNS-120 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection, Command injection - [D-Link DNS-1550-04 gui_mgr.cgi cgi_mycloud_auto_downlaod command injection](https://agentprime.io/advisories/CVE-2026-4204.md) `CVE-2026-4204` · CVE record: D-Link DNS-120 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection, Command injection - [D-Link DNS-1550-04 network_mgr.cgi cgi_dhcpd command injection](https://agentprime.io/advisories/CVE-2026-4203.md) `CVE-2026-4203` · CVE record: D-Link DNS-120 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection, Command injection - [bazinga012 mcp_code_executor index.ts installDependencies command injection](https://agentprime.io/advisories/CVE-2026-4199.md) `CVE-2026-4199` · CVE record: bazinga012 mcp_code_executor · CVSS 4.8 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection, Command injection - [hypermodel-labs mcp-server-auto-commit index.ts getGitChanges command injection](https://agentprime.io/advisories/CVE-2026-4198.md) `CVE-2026-4198` · CVE record: hypermodel-labs mcp-server-auto-commit · CVSS 4.8 Medium · Not analysed yet · Published 15 Mar 2026 · Tags: Other injection, Command injection - [D-Link DNS-1550-04 download_mgr.cgi RSS_Item_List command injection](https://agentprime.io/advisories/CVE-2026-4197.md) `CVE-2026-4197` · CVE record: D-Link DNS-120 and 4 more · CVSS 5.3 Medium · EPSS 0.22 · Not analysed yet · Published 15 Mar 2026 · Tags: Other injection, Command injection - [D-Link DNS-1550-04 remote_backup.cgi cgi_set_rsync_server command injection](https://agentprime.io/advisories/CVE-2026-4196.md) `CVE-2026-4196` · CVE record: D-Link DNS-120 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 15 Mar 2026 · Tags: Other injection, Command injection - [D-Link DNS-1550-04 wizard_mgr.cgi command injection](https://agentprime.io/advisories/CVE-2026-4195.md) `CVE-2026-4195` · CVE record: D-Link DNS-120 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 15 Mar 2026 · Tags: Other injection, Command injection - [AvinashBole quip-mcp-server index.ts setupToolHandlers command injection](https://agentprime.io/advisories/CVE-2026-4192.md) `CVE-2026-4192` · CVE record: AvinashBole quip-mcp-server · CVSS 5.3 Medium · Not analysed yet · Published 15 Mar 2026 · Tags: Other injection, Command injection - [JawherKl node-api-postgres user.js User.getAll sql injection](https://agentprime.io/advisories/CVE-2026-4190.md) `CVE-2026-4190` · CVE record: JawherKl node-api-postgres · CVSS 6.9 Medium · Not analysed yet · Published 15 Mar 2026 · Tags: Other injection, SQL injection - [phpipam Section edit-result.php sql injection](https://agentprime.io/advisories/CVE-2026-4189.md) `CVE-2026-4189` · CVE record: phpipam · CVSS 5.1 Medium · Not analysed yet · Published 15 Mar 2026 · Tags: Other injection, SQL injection - [CodePhiliaX Chat2DB Database Export DMDBManage.java updateProcedure sql injection](https://agentprime.io/advisories/CVE-2026-4173.md) `CVE-2026-4173` · CVE record: CodePhiliaX Chat2DB · CVSS 5.3 Medium · Not analysed yet · Published 15 Mar 2026 · Tags: Other injection, SQL injection - [Wavlink WL-WN578W2 POST Request wireless.cgi GuestWifi command injection](https://agentprime.io/advisories/CVE-2026-4164.md) `CVE-2026-4164` · CVE record: Wavlink WL-WN578W2 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Mar 2026 · Tags: Other injection, Command injection - [Wavlink WL-WN579A3 POST Request wireless.cgi GuestWifi command injection](https://agentprime.io/advisories/CVE-2026-4163.md) `CVE-2026-4163` · CVE record: Wavlink WL-WN579A3 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Mar 2026 · Tags: Other injection, Command injection - [Pigeon has a Host Header Injection in email verification flow](https://agentprime.io/advisories/CVE-2026-32616.md) `CVE-2026-32616` · CVE record: kasuganosoras Pigeon · CVSS 8.2 High · Not analysed yet · Published 13 Mar 2026 · Tags: Other injection - [Undici has CRLF Injection in undici via \`upgrade\` option](https://agentprime.io/advisories/GHSA-4992-7rv2-5pvq.md) `GHSA-4992-7rv2-5pvq`, `CVE-2026-1527` · npm `undici`: affected `<6.24.0 || >=7.0.0, <7.24.0`, fixed in `6.24.0`, `7.24.0` · CVSS 4.6 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: Other injection - [tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling](https://agentprime.io/advisories/CVE-2025-13462.md) `CVE-2025-13462` · CVE record: Python Software Foundation CPython · CVSS 2.0 Low · Not analysed yet · Published 12 Mar 2026 · Tags: Other injection, Unrestricted file upload, CWE-20 - [Parse Server: Account takeover via operator injection in authentication data identifier](https://agentprime.io/advisories/GHSA-5fw2-8jcv-xh87.md) `GHSA-5fw2-8jcv-xh87`, `BIT-parse-2026-32248`, `CVE-2026-32248` · npm `parse-server`: affected `<8.6.38 || >=9.0.0, <9.6.0-alpha.12`, fixed in `8.6.38`, `9.6.0-alpha.12` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Mar 2026 · Tags: Other injection - [Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters](https://agentprime.io/advisories/GHSA-gg5m-55jj-8m5g.md) `GHSA-gg5m-55jj-8m5g`, `CVE-2026-32247`, `PYSEC-2026-2504` · PyPI `graphiti-core`: affected `<0.28.2`, fixed in `0.28.2` · CVSS 8.1 High · Not analysed yet · Published 12 Mar 2026 · Tags: Other injection - [OliveTin's email argument makes compliance harder, enables log injection](https://agentprime.io/advisories/GHSA-xx6g-43w2-9g6g.md) `GHSA-xx6g-43w2-9g6g`, `GO-2026-4687` · Go `github.com/OliveTin/OliveTin`: affected `<3000.11.3`, fixed in `3000.11.3` · CVSS 4.0, no score published · Not analysed yet · Published 12 Mar 2026 · Tags: Other injection, Information disclosure - [Duplicate Advisory: OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth)](https://agentprime.io/advisories/GHSA-wgx8-r9vw-2w4h.md) `GHSA-wgx8-r9vw-2w4h` · npm `openclaw`: affected `<2026.2.21`, fixed in `2026.2.21` · CVSS 6.3 Medium · Withdrawn · Not analysed yet · Published 12 Mar 2026 · Tags: Other injection - [Mod_proxy_cluster: mod_proxy_cluster: response body corruption via crlf injection](https://agentprime.io/advisories/CVE-2026-3234.md) `CVE-2026-3234` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 2 more · CVSS 4.3 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Other injection - [itsourcecode Cafe Reservation System Registration signup.php sql injection](https://agentprime.io/advisories/CVE-2026-4014.md) `CVE-2026-4014` · CVE record: itsourcecode Cafe Reservation System · CVSS 6.9 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Other injection, SQL injection - [CodeGenieApp serverless-express Users Endpoint dynamodb.ts injection](https://agentprime.io/advisories/CVE-2026-3992.md) `CVE-2026-3992` · CVE record: CodeGenieApp serverless-express · CVSS 5.3 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Other injection, CWE-707 - [itsourcecode Online Doctor Appointment System doctor_action.php sql injection](https://agentprime.io/advisories/CVE-2026-3981.md) `CVE-2026-3981` · CVE record: itsourcecode Online Doctor Appointment System · CVSS 6.9 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Doctor Appointment System patient_action.php sql injection](https://agentprime.io/advisories/CVE-2026-3980.md) `CVE-2026-3980` · CVE record: itsourcecode Online Doctor Appointment System · CVSS 6.9 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Other injection, SQL injection - [FeMiner wms Basic Organizational Structure depart_add_bg.php sql injection](https://agentprime.io/advisories/CVE-2026-3969.md) `CVE-2026-3969` · CVE record: FeMiner wms · CVSS 6.9 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Other injection, SQL injection - [AutohomeCorp frostmourne Oracle Nashorn JavaScript ExpressionRule.java scriptEngine.eval code injection](https://agentprime.io/advisories/CVE-2026-3968.md) `CVE-2026-3968` · CVE record: AutohomeCorp frostmourne · CVSS 5.3 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Other injection, Code injection - [xierongwkhd weimai-wetapp Endpoint HomeController.java getLikeMovieList sql injection](https://agentprime.io/advisories/CVE-2026-3957.md) `CVE-2026-3957` · CVE record: xierongwkhd weimai-wetapp · CVSS 5.1 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Other injection, SQL injection - [xierongwkhd weimai-wetapp Admin_AdminUserController.java getAdmins sql injection](https://agentprime.io/advisories/CVE-2026-3956.md) `CVE-2026-3956` · CVE record: xierongwkhd weimai-wetapp · CVSS 5.1 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Other injection, SQL injection - [elecV2P jsfile Endpoint wbjs.js runJSFile code injection](https://agentprime.io/advisories/CVE-2026-3955.md) `CVE-2026-3955` · CVE record: elecV2P · CVSS 5.3 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Other injection, Code injection - [Improper Neutralization of CRLF Sequences ('CRLF Injection') in GitLab](https://agentprime.io/advisories/CVE-2026-3848.md) `CVE-2026-3848` · CVE record: GitLab GitLab · CVSS 5.0 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Other injection - [Traefik: kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values](https://agentprime.io/advisories/GHSA-8q2w-wr49-whqj.md) `GHSA-8q2w-wr49-whqj`, `CVE-2026-29777`, `GO-2026-4679` · Go `github.com/traefik/traefik` and 2 more: affected `<=1.7.34`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Other injection - [itsourcecode University Management System att_add.php sql injection](https://agentprime.io/advisories/CVE-2026-3944.md) `CVE-2026-3944` · CVE record: itsourcecode University Management System · CVSS 6.9 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Other injection, SQL injection - [H3C ACG1000-AK230 aaa_portal_auth_local_submit command injection](https://agentprime.io/advisories/CVE-2026-3943.md) `CVE-2026-3943` · CVE record: H3C ACG1000-AK230 · CVSS 6.9 Medium · EPSS 0.43 · Not analysed yet · Published 11 Mar 2026 · Tags: Other injection, Command injection - [Parse Server vulnerable to LDAP injection via unsanitized user input in DN and group filter construction](https://agentprime.io/advisories/GHSA-7m6r-fhh7-r47c.md) `GHSA-7m6r-fhh7-r47c`, `BIT-parse-2026-31828`, `CVE-2026-31828` · npm `parse-server`: affected `<8.6.26 || >=9.0.0-alpha.1, <9.5.2-alpha.13`, fixed in `8.6.26`, `9.5.2-alpha.13` · CVSS 6.0 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Other injection - [Parse Server has a NoSQL injection via token type in password reset and email verification endpoints](https://agentprime.io/advisories/GHSA-vgjh-hmwf-c588.md) `GHSA-vgjh-hmwf-c588`, `BIT-parse-2026-30941`, `CVE-2026-30941` · npm `parse-server`: affected `<8.6.14 || >=9.0.0, <9.5.2-alpha.1`, fixed in `8.6.14`, `9.5.2-alpha.1` · CVSS 8.7 High · Not analysed yet · Published 11 Mar 2026 · Tags: Other injection - [Sylius has a DQL Injection via API Order Filters](https://agentprime.io/advisories/GHSA-xcwx-r2gw-w93m.md) `GHSA-xcwx-r2gw-w93m`, `CVE-2026-31825`, `PKSA-6fr5-nks6-h5j2` · Packagist `sylius/sylius`: affected `<1.9.12 || >=1.10.0, <1.10.16 || >=1.11.0, <1.11.17 || >=1.12.0, <1.12.23 || >=1.13.0, <1.13.15 || >=1.14.0, <1.14.18 || >=2.0.0, <2.0.16 || >=2.1.0, <2.1.12 || >=2.2.0, <2.2.3`, fixed in `1.9.12`, `1.10.16`, `1.11.17`, `1.12.23`, `1.13.15`, `1.14.18`, `2.0.16`, `2.1.12`, `2.2.3` · CVSS 5.3 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: SQL injection, Other injection - [Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter](https://agentprime.io/advisories/GHSA-p9xr-7p9p-gpqx.md) `GHSA-p9xr-7p9p-gpqx`, `CVE-2026-29793` · npm `@feathersjs/mongodb`: affected `>=5.0.0, <5.0.42`, fixed in `5.0.42` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Mar 2026 · Tags: Other injection - [Budibase Universal Auth Bypass via Webhook Query Param Injection](https://agentprime.io/advisories/CVE-2026-31816.md) `CVE-2026-31816` · CVE record: Budibase budibase · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.17 · Not analysed yet · Published 9 Mar 2026 · Tags: Other injection - [Tiandy Easy7 CMS Windows GetDBData.jsp sql injection](https://agentprime.io/advisories/CVE-2026-3818.md) `CVE-2026-3818` · CVE record: Tiandy Easy7 CMS Windows · CVSS 6.9 Medium · Not analysed yet · Published 9 Mar 2026 · Tags: Other injection, SQL injection - [opencc JFlow WF_CCForm.java Calculate injection](https://agentprime.io/advisories/CVE-2026-3813.md) `CVE-2026-3813` · CVE record: opencc JFlow · CVSS 5.3 Medium · Not analysed yet · Published 9 Mar 2026 · Tags: Other injection, CWE-707 - [SourceCodester/janobe Resort Reservation System room_rates.php sql injection](https://agentprime.io/advisories/CVE-2026-3806.md) `CVE-2026-3806` · CVE record: SourceCodester Resort Reservation System and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 9 Mar 2026 · Tags: Other injection, SQL injection - [Comfast CF-AC100 Request Path mbox-config sub_44AC14 command injection](https://agentprime.io/advisories/CVE-2026-3798.md) `CVE-2026-3798` · CVE record: Comfast CF-AC100 · CVSS 5.1 Medium · EPSS 0.17 · Not analysed yet · Published 9 Mar 2026 · Tags: Other injection, Command injection - [SourceCodester Sales and Inventory System GET Parameter sales_invoice1.php sql injection](https://agentprime.io/advisories/CVE-2026-3793.md) `CVE-2026-3793` · CVE record: SourceCodester Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 9 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Sales and Inventory System GET Parameter purchase_invoice.php sql injection](https://agentprime.io/advisories/CVE-2026-3792.md) `CVE-2026-3792` · CVE record: SourceCodester Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 9 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Sales and Inventory System Search dashboard.php sql injection](https://agentprime.io/advisories/CVE-2026-3791.md) `CVE-2026-3791` · CVE record: SourceCodester Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 9 Mar 2026 · Tags: Other injection, SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .