# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [SourceCodester Online Library Management System Parameter home.php sql injection](https://agentprime.io/advisories/CVE-2026-4624.md) `CVE-2026-4624` · CVE record: SourceCodester Online Library Management System · CVSS 6.9 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Catering Reservation search.php sql injection](https://agentprime.io/advisories/CVE-2026-4615.md) `CVE-2026-4615` · CVE record: SourceCodester Online Catering Reservation · CVSS 6.9 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Other injection, SQL injection - [itsourcecode sanitize or validate this input Parameter subjects.php sql injection](https://agentprime.io/advisories/CVE-2026-4614.md) `CVE-2026-4614` · CVE record: itsourcecode sanitize or validate this input · CVSS 5.3 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester E-Commerce Site products.php sql injection](https://agentprime.io/advisories/CVE-2026-4613.md) `CVE-2026-4613` · CVE record: SourceCodester E-Commerce Site · CVSS 6.9 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Other injection, SQL injection - [itsourcecode Free Hotel Reservation System Parameter index.php sql injection](https://agentprime.io/advisories/CVE-2026-4612.md) `CVE-2026-4612` · CVE record: itsourcecode Free Hotel Reservation System · CVSS 6.9 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Other injection, SQL injection - [Rails Active Storage has possible glob injection in its DiskService](https://agentprime.io/advisories/GHSA-73f9-jhhh-hr5m.md) `GHSA-73f9-jhhh-hr5m`, `CVE-2026-33202` · RubyGems `activestorage`: affected `<7.2.3.1 || >=8.0.0.beta1, <8.0.4.1 || >=8.1.0.beta1, <8.1.2.1`, fixed in `7.2.3.1`, `8.0.4.1`, `8.1.2.1` · CVSS 6.6 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Other injection - [648540858 wvp-GB28181-pro Stream Proxy Query StreamProxyProvider.java selectAll sql injection](https://agentprime.io/advisories/CVE-2026-4597.md) `CVE-2026-4597` · CVE record: 648540858 wvp-GB28181-pro · CVSS 5.3 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Other injection, SQL injection - [code-projects Simple Laundry System Parameters checklogin.php sql injection](https://agentprime.io/advisories/CVE-2026-4581.md) `CVE-2026-4581` · CVE record: code-projects Simple Laundry System · CVSS 6.9 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Other injection, SQL injection - [code-projects Simple Laundry System Parameters checkupdatestatus.php sql injection](https://agentprime.io/advisories/CVE-2026-4580.md) `CVE-2026-4580` · CVE record: code-projects Simple Laundry System · CVSS 6.9 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Other injection, SQL injection - [code-projects Simple Laundry System Parameters viewdetail.php sql injection](https://agentprime.io/advisories/CVE-2026-4579.md) `CVE-2026-4579` · CVE record: code-projects Simple Laundry System · CVSS 6.9 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Simple E-learning System User Profile Update sql injection](https://agentprime.io/advisories/CVE-2026-4574.md) `CVE-2026-4574` · CVE record: SourceCodester Simple E-learning System · CVSS 5.3 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Simple E-learning System HTTP GET Parameter delete_post.php sql injection](https://agentprime.io/advisories/CVE-2026-4573.md) `CVE-2026-4573` · CVE record: SourceCodester Simple E-learning System · CVSS 5.3 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Sales and Inventory System HTTP POST Request view_product.php sql injection](https://agentprime.io/advisories/CVE-2026-4572.md) `CVE-2026-4572` · CVE record: SourceCodester Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Sales and Inventory System HTTP POST Request view_payments.php sql injection](https://agentprime.io/advisories/CVE-2026-4571.md) `CVE-2026-4571` · CVE record: SourceCodester Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Sales and Inventory System HTTP POST Request view_customers.php sql injection](https://agentprime.io/advisories/CVE-2026-4570.md) `CVE-2026-4570` · CVE record: SourceCodester Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Sales and Inventory System HTTP POST Request view_category.php sql injection](https://agentprime.io/advisories/CVE-2026-4569.md) `CVE-2026-4569` · CVE record: SourceCodester Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Sales and Inventory System HTTP GET Request update_supplier.php sql injection](https://agentprime.io/advisories/CVE-2026-4568.md) `CVE-2026-4568` · CVE record: SourceCodester Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Other injection, SQL injection - [yangzongzhuan RuoYi Quartz Job job code injection](https://agentprime.io/advisories/CVE-2026-4564.md) `CVE-2026-4564` · CVE record: yangzongzhuan RuoYi · CVSS 5.1 Medium · Not analysed yet · Published 22 Mar 2026 · Tags: Other injection, Code injection - [Tenda F453 WriteFacMac FormWriteFacMac privilege escalation](https://agentprime.io/advisories/CVE-2026-4554.md) `CVE-2026-4554` · CVE record: Tenda F453 · CVSS 5.3 Medium · Not analysed yet · Published 22 Mar 2026 · Tags: Other injection, Command injection - [code-projects Simple Gym Management System func.php sql injection](https://agentprime.io/advisories/CVE-2026-4550.md) `CVE-2026-4550` · CVE record: code-projects Simple Gym Management System · CVSS 5.1 Medium · Not analysed yet · Published 22 Mar 2026 · Tags: Other injection, SQL injection - [Wavlink WL-WN578W2 POST Request firewall.cgi command injection](https://agentprime.io/advisories/CVE-2026-4543.md) `CVE-2026-4543` · CVE record: Wavlink WL-WN578W2 · CVSS 5.3 Medium · Not analysed yet · Published 22 Mar 2026 · Tags: Other injection, Command injection - [projectworlds Online Notes Sharing System Parameters login.php sql injection](https://agentprime.io/advisories/CVE-2026-4540.md) `CVE-2026-4540` · CVE record: projectworlds Online Notes Sharing System · CVSS 6.9 Medium · Not analysed yet · Published 22 Mar 2026 · Tags: Other injection, SQL injection - [Cudy TR1200 ipsec.lua action_ipsec_conn command injection](https://agentprime.io/advisories/CVE-2026-4537.md) `CVE-2026-4537` · CVE record: Cudy TR1200 · CVSS 5.1 Medium · Not analysed yet · Published 22 Mar 2026 · Tags: Other injection, Command injection - [code-projects Simple Food Ordering System all-tickets.php sql injection](https://agentprime.io/advisories/CVE-2026-4533.md) `CVE-2026-4533` · CVE record: code-projects Simple Food Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 22 Mar 2026 · Tags: Other injection, SQL injection - [apconw Aix-DB terminology_retriever.py sql injection](https://agentprime.io/advisories/CVE-2026-4530.md) `CVE-2026-4530` · CVE record: apconw Aix-DB · CVSS 4.8 Medium · Not analysed yet · Published 21 Mar 2026 · Tags: Other injection, SQL injection - [Foundation Agents MetaGPT DataInterpreter write_analysis_code.py injection](https://agentprime.io/advisories/CVE-2026-4516.md) `CVE-2026-4516` · CVE record: Foundation Agents MetaGPT · CVSS 5.3 Medium · Not analysed yet · Published 21 Mar 2026 · Tags: Other injection, CWE-707 - [Foundation Agents MetaGPT operator.py code_generate code injection](https://agentprime.io/advisories/CVE-2026-4515.md) `CVE-2026-4515` · CVE record: Foundation Agents MetaGPT · CVSS 5.3 Medium · Not analysed yet · Published 21 Mar 2026 · Tags: Other injection, Code injection - [vanna-ai vanna base.py ask sql injection](https://agentprime.io/advisories/CVE-2026-4513.md) `CVE-2026-4513` · CVE record: vanna-ai vanna · CVSS 5.3 Medium · Not analysed yet · Published 21 Mar 2026 · Tags: Other injection, SQL injection - [vanna-ai vanna legacy exec injection](https://agentprime.io/advisories/CVE-2026-4511.md) `CVE-2026-4511` · CVE record: vanna-ai vanna · CVSS 5.3 Medium · Not analysed yet · Published 21 Mar 2026 · Tags: Other injection, CWE-707 - [MindSQL is vulnerable to Code Injection through its ask_db function](https://agentprime.io/advisories/GHSA-m6m4-34cj-4hh7.md) `GHSA-m6m4-34cj-4hh7`, `CVE-2026-4506`, `PYSEC-2026-2649` · PyPI `mindsql`: affected `<=0.2.1`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 21 Mar 2026 · Tags: Other injection, Code injection - [PbootCMS Member Login MemberController.php checkUsername sql injection](https://agentprime.io/advisories/CVE-2026-4508.md) `CVE-2026-4508` · CVE record: PbootCMS · CVSS 6.9 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Other injection, SQL injection - [Mindinventory MindSQL mindsql_core.py ask_db sql injection](https://agentprime.io/advisories/CVE-2026-4507.md) `CVE-2026-4507` · CVE record: Mindinventory MindSQL · CVSS 5.3 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Other injection, SQL injection - [h3: SSE Event Injection via Unsanitized Carriage Return (\`\r\`) in EventStream Data and Comment Fields (Bypass of CVE Fix)](https://agentprime.io/advisories/GHSA-4hxc-9384-m385.md) `GHSA-4hxc-9384-m385`, `CVE-2026-86252` · npm `h3`: affected `<1.15.9 || >=2.0.0-beta.0, <2.0.1-rc.17`, fixed in `1.15.9`, `2.0.1-rc.17` · CVSS 6.9 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Other injection - [eosphoros-ai db-gpt Incomplete Fix editor sql injection](https://agentprime.io/advisories/CVE-2026-4504.md) `CVE-2026-4504` · CVE record: eosphoros-ai db-gpt · CVSS 6.9 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Other injection, SQL injection - [bagofwords1 bagofwords code_execution.py generate_df injection](https://agentprime.io/advisories/CVE-2026-4500.md) `CVE-2026-4500` · CVE record: bagofwords1 bagofwords · CVSS 5.3 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Other injection, CWE-707 - [itsourcecode College Management System search_student.php sql injection](https://agentprime.io/advisories/CVE-2026-4485.md) `CVE-2026-4485` · CVE record: itsourcecode College Management System · CVSS 5.3 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Doctor Appointment System appointment_action.php sql injection](https://agentprime.io/advisories/CVE-2026-4473.md) `CVE-2026-4473` · CVE record: itsourcecode Online Doctor Appointment System · CVSS 5.1 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Frozen Foods Ordering System admin_edit_supplier.php sql injection](https://agentprime.io/advisories/CVE-2026-4472.md) `CVE-2026-4472` · CVE record: itsourcecode Online Frozen Foods Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Frozen Foods Ordering System admin_edit_employee.php sql injection](https://agentprime.io/advisories/CVE-2026-4471.md) `CVE-2026-4471` · CVE record: itsourcecode Online Frozen Foods Ordering System · CVSS 5.1 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Frozen Foods Ordering System admin_edit_menu.php sql injection](https://agentprime.io/advisories/CVE-2026-4470.md) `CVE-2026-4470` · CVE record: itsourcecode Online Frozen Foods Ordering System · CVSS 5.1 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Frozen Foods Ordering System admin_edit_menu_action.php sql injection](https://agentprime.io/advisories/CVE-2026-4469.md) `CVE-2026-4469` · CVE record: itsourcecode Online Frozen Foods Ordering System · CVSS 5.1 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Other injection, SQL injection - [Comfast CF-AC100 mbox-config command injection](https://agentprime.io/advisories/CVE-2026-4468.md) `CVE-2026-4468` · CVE record: Comfast CF-AC100 · CVSS 5.1 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Other injection, Command injection - [Comfast CF-AC100 mbox-config command injection](https://agentprime.io/advisories/CVE-2026-4467.md) `CVE-2026-4467` · CVE record: Comfast CF-AC100 · CVSS 5.1 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Other injection, Command injection - [Comfast CF-AC100 mbox-config command injection](https://agentprime.io/advisories/CVE-2026-4466.md) `CVE-2026-4466` · CVE record: Comfast CF-AC100 · CVSS 5.1 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Other injection, Command injection - [SuiterCRM has LDAP Filter Injection in Authentication Module](https://agentprime.io/advisories/CVE-2026-33289.md) `CVE-2026-33289` · CVE record: SuiteCRM SuiteCRM · CVSS 8.8 High · Not analysed yet · Published 19 Mar 2026 · Tags: Other injection - [OpenWrt procd PATH Environment Variable Filter Bypass via Incorrect String Comparison Leads to Privilege Escalation](https://agentprime.io/advisories/CVE-2026-30874.md) `CVE-2026-30874` · CVE record: openwrt openwrt · CVSS 1.8 Low · Not analysed yet · Published 19 Mar 2026 · Tags: Other injection, Privilege escalation, CWE-187 - [SQLBot: Remote Code Execution via Terminology Poisoning](https://agentprime.io/advisories/CVE-2026-32622.md) `CVE-2026-32622` · CVE record: dataease SQLBot · CVSS 8.6 High · Not analysed yet · Published 19 Mar 2026 · Tags: Other injection, Command injection, Broken access control, CWE-20 - [Ubiquiti Inc UniFi Network Application: An Authenticated NoSQL Injection vulnerability found in UniFi Network Application could…](https://agentprime.io/advisories/CVE-2026-22558.md) `CVE-2026-22558` · CVE record: Ubiquiti Inc UniFi Network Application · CVSS 7.7 High · Not analysed yet · Published 19 Mar 2026 · Tags: Other injection - [h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields](https://agentprime.io/advisories/GHSA-22cc-p3c6-wpvm.md) `GHSA-22cc-p3c6-wpvm`, `CVE-2026-33128` · npm `h3`: affected `<1.15.6 || >=2.0.0, <2.0.1-rc.15`, fixed in `1.15.6`, `2.0.1-rc.15` · CVSS 7.5 High · Not analysed yet · Published 18 Mar 2026 · Tags: Other injection - [code-projects Simple Food Order System add-item.php sql injection](https://agentprime.io/advisories/CVE-2026-4319.md) `CVE-2026-4319` · CVE record: code-projects Simple Food Order System · CVSS 6.9 Medium · Not analysed yet · Published 17 Mar 2026 · Tags: Other injection, SQL injection - [Libsoup: libsoup: header and http request injection via crlf injection](https://agentprime.io/advisories/CVE-2026-3633.md) `CVE-2026-3633` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 3.9 Low · Not analysed yet · Published 17 Mar 2026 · Tags: Other injection - [Libsoup: libsoup: http header injection and response splitting via crlf injection in content-type header](https://agentprime.io/advisories/CVE-2026-3634.md) `CVE-2026-3634` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 3.9 Low · Not analysed yet · Published 17 Mar 2026 · Tags: Other injection - [Tiandy Easy7 Integrated Management Platform getRecByTemplateId sql injection](https://agentprime.io/advisories/CVE-2026-4289.md) `CVE-2026-4289` · CVE record: Tiandy Easy7 Integrated Management Platform · CVSS 6.9 Medium · Not analysed yet · Published 17 Mar 2026 · Tags: Other injection, SQL injection - [Tiandy Easy7 Integrated Management Platform Endpoint getDevDetailedInfo sql injection](https://agentprime.io/advisories/CVE-2026-4288.md) `CVE-2026-4288` · CVE record: Tiandy Easy7 Integrated Management Platform · CVSS 6.9 Medium · Not analysed yet · Published 17 Mar 2026 · Tags: Other injection, SQL injection - [Tiandy Easy7 Integrated Management Platform Endpoint queryResources sql injection](https://agentprime.io/advisories/CVE-2026-4287.md) `CVE-2026-4287` · CVE record: Tiandy Easy7 Integrated Management Platform · CVSS 6.9 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection, SQL injection - [Vanna has a SQL injection in the remove_training_data function](https://agentprime.io/advisories/GHSA-6mj8-jmp2-g8q7.md) `GHSA-6mj8-jmp2-g8q7`, `CVE-2026-4229`, `PYSEC-2026-3397` · PyPI `vanna`: affected `<=2.0.2`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection, SQL injection - [itsourcecode College Management System time-table.php sql injection](https://agentprime.io/advisories/CVE-2026-4241.md) `CVE-2026-4241` · CVE record: itsourcecode College Management System · CVSS 5.3 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection, SQL injection - [itsourcecode College Management System courses.php sql injection](https://agentprime.io/advisories/CVE-2026-4238.md) `CVE-2026-4238` · CVE record: itsourcecode College Management System · CVSS 5.1 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection, SQL injection - [itsourcecode Free Hotel Reservation System index.php sql injection](https://agentprime.io/advisories/CVE-2026-4237.md) `CVE-2026-4237` · CVE record: itsourcecode Free Hotel Reservation System · CVSS 6.9 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Enrollment System index.php sql injection](https://agentprime.io/advisories/CVE-2026-4236.md) `CVE-2026-4236` · CVE record: itsourcecode Online Enrollment System · CVSS 6.9 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Other injection, SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .