# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Totolink A3300R Parameter cstecgi.cgi setSmartQosCfg command injection](https://agentprime.io/advisories/CVE-2026-5102.md) `CVE-2026-5102` · CVE record: Totolink A3300R · CVSS 5.3 Medium · Not analysed yet · Published 30 Mar 2026 · Tags: Other injection, Command injection - [Totolink A3300R Parameter cstecgi.cgi setLanCfg command injection](https://agentprime.io/advisories/CVE-2026-5101.md) `CVE-2026-5101` · CVE record: Totolink A3300R · CVSS 5.3 Medium · Not analysed yet · Published 29 Mar 2026 · Tags: Other injection, Command injection - [code-projects Chamber of Commerce Membership Management System pageMail.php fwrite command injection](https://agentprime.io/advisories/CVE-2026-5041.md) `CVE-2026-5041` · CVE record: code-projects Chamber of Commerce Membership Management System · CVSS 5.1 Medium · Not analysed yet · Published 29 Mar 2026 · Tags: Other injection, Command injection - [code-projects Accounting System Parameter view_work.php sql injection](https://agentprime.io/advisories/CVE-2026-5035.md) `CVE-2026-5035` · CVE record: code-projects Accounting System · CVSS 6.9 Medium · Not analysed yet · Published 29 Mar 2026 · Tags: Other injection, SQL injection - [code-projects Accounting System Parameter edit_costumer.php sql injection](https://agentprime.io/advisories/CVE-2026-5034.md) `CVE-2026-5034` · CVE record: code-projects Accounting System · CVSS 6.9 Medium · Not analysed yet · Published 29 Mar 2026 · Tags: Other injection, SQL injection - [code-projects Accounting System Parameter view_costumer.php sql injection](https://agentprime.io/advisories/CVE-2026-5033.md) `CVE-2026-5033` · CVE record: code-projects Accounting System · CVSS 6.9 Medium · Not analysed yet · Published 29 Mar 2026 · Tags: Other injection, SQL injection - [Totolink NR1800X Telnet Service cstecgi.cgi NTPSyncWithHost command injection](https://agentprime.io/advisories/CVE-2026-5030.md) `CVE-2026-5030` · CVE record: Totolink NR1800X · CVSS 5.3 Medium · Not analysed yet · Published 29 Mar 2026 · Tags: Other injection, Command injection - [Totolink A3600R Parameter cstecgi.cgi setNoticeCfg command injection](https://agentprime.io/advisories/CVE-2026-5020.md) `CVE-2026-5020` · CVE record: Totolink A3600R · CVSS 5.3 Medium · Not analysed yet · Published 29 Mar 2026 · Tags: Other injection, Command injection - [code-projects Simple Food Order System Parameter all-orders.php sql injection](https://agentprime.io/advisories/CVE-2026-5019.md) `CVE-2026-5019` · CVE record: code-projects Simple Food Order System · CVSS 6.9 Medium · Not analysed yet · Published 28 Mar 2026 · Tags: Other injection, SQL injection - [code-projects Simple Food Order System Parameter register-router.php sql injection](https://agentprime.io/advisories/CVE-2026-5018.md) `CVE-2026-5018` · CVE record: code-projects Simple Food Order System · CVSS 6.9 Medium · Not analysed yet · Published 28 Mar 2026 · Tags: Other injection, SQL injection - [code-projects Simple Food Order System Parameter all-tickets.php sql injection](https://agentprime.io/advisories/CVE-2026-5017.md) `CVE-2026-5017` · CVE record: code-projects Simple Food Order System · CVSS 6.9 Medium · Not analysed yet · Published 28 Mar 2026 · Tags: Other injection, SQL injection - [elecV2 elecV2P JSON webhook runJSFile code injection](https://agentprime.io/advisories/CVE-2026-5011.md) `CVE-2026-5011` · CVE record: elecV2 elecV2P · CVSS 5.3 Medium · Not analysed yet · Published 28 Mar 2026 · Tags: Other injection, Code injection - [PromtEngineer localGPT LLM Prompt server.py \_route_using_overviews injection](https://agentprime.io/advisories/CVE-2026-5002.md) `CVE-2026-5002` · CVE record: PromtEngineer localGPT · CVSS 6.9 Medium · Not analysed yet · Published 28 Mar 2026 · Tags: Other injection, CWE-707 - [Sinaptik AI PandasAI Chat Message code_executor.py CodeExecutor.execute code injection](https://agentprime.io/advisories/CVE-2026-4998.md) `CVE-2026-4998` · CVE record: Sinaptik AI PandasAI · CVSS 6.9 Medium · Not analysed yet · Published 28 Mar 2026 · Tags: Other injection, Code injection - [Sinaptik AI PandasAI pandasai-lancedb Extension lancedb.py get_relevant_docs_by_id sql injection](https://agentprime.io/advisories/CVE-2026-4996.md) `CVE-2026-4996` · CVE record: Sinaptik AI PandasAI · CVSS 6.9 Medium · Not analysed yet · Published 28 Mar 2026 · Tags: Other injection, SQL injection - [Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'](https://agentprime.io/advisories/CVE-2026-2442.md) `CVE-2026-2442` · CVE record: softaculous Page Builder: Pagelayer – Drag and Drop website builder · CVSS 5.3 Medium · Not analysed yet · Published 28 Mar 2026 · Tags: Other injection - [AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters](https://agentprime.io/advisories/GHSA-27qh-8cxx-2cr5.md) `GHSA-27qh-8cxx-2cr5`, `PKSA-4t1p-xpk2-nsss` · Packagist `aws/aws-sdk-php`: affected `>=3.11.7, <3.371.4`, fixed in `3.371.4` · CVSS 4.0, no score published · Not analysed yet · Published 27 Mar 2026 · Tags: Other injection, CWE-20, CWE-150 - [act: Unrestricted set-env and add-path command processing enables environment injection](https://agentprime.io/advisories/GHSA-xmgr-9pqc-h5vw.md) `GHSA-xmgr-9pqc-h5vw`, `CVE-2026-34041`, `GO-2026-4891` · Go `github.com/nektos/act`: affected `<0.2.86`, fixed in `0.2.86` · CVSS 7.7 High · Not analysed yet · Published 27 Mar 2026 · Tags: Other injection - [Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries](https://agentprime.io/advisories/GHSA-vphc-468g-8rfp.md) `GHSA-vphc-468g-8rfp`, `CVE-2026-33980`, `PYSEC-2026-2327` · PyPI `adx-mcp-server`: affected `<=1.1.0`, no fixed version yet · CVSS 8.3 High · Not analysed yet · Published 27 Mar 2026 · Tags: Other injection - [Hugging Face Smolagents has an Injection issue](https://agentprime.io/advisories/GHSA-54fq-v6x8-244g.md) `GHSA-54fq-v6x8-244g`, `CVE-2026-4963`, `PYSEC-2026-3066` · PyPI `smolagents`: affected `<=1.25.0.dev0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: Other injection, Code injection - [code-projects Social Networking Site Endpoint delete_photos.php sql injection](https://agentprime.io/advisories/CVE-2026-4970.md) `CVE-2026-4970` · CVE record: code-projects Social Networking Site · CVSS 5.3 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: Other injection, SQL injection - [Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass](https://agentprime.io/advisories/GHSA-67jx-r9pv-98rj.md) `GHSA-67jx-r9pv-98rj`, `CVE-2026-32695`, `GO-2026-4880` · Go `github.com/traefik/traefik/v2` and 1 more: affected `<=2.11.42`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: Other injection, Code injection - [itsourcecode Free Hotel Reservation System index.php sql injection](https://agentprime.io/advisories/CVE-2026-4966.md) `CVE-2026-4966` · CVE record: itsourcecode Free Hotel Reservation System · CVSS 5.3 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: Other injection, SQL injection - [Shenzhen Ruiming Technology Streamax Crocus Parameter DevicePrint.do sql injection](https://agentprime.io/advisories/CVE-2026-4956.md) `CVE-2026-4956` · CVE record: Shenzhen Ruiming Technology Streamax Crocus · CVSS 6.9 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: Other injection, SQL injection - [Shenzhen Ruiming Technology Streamax Crocus OperateStatistic.do sql injection](https://agentprime.io/advisories/CVE-2026-4955.md) `CVE-2026-4955` · CVE record: Shenzhen Ruiming Technology Streamax Crocus · CVSS 6.9 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: Other injection, SQL injection - [mingSoft MCMS Web Content List Endpoint ContentAction.java list sql injection](https://agentprime.io/advisories/CVE-2026-4954.md) `CVE-2026-4954` · CVE record: mingSoft MCMS · CVSS 5.3 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: Other injection, SQL injection - [LDAP injection in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2026-27860.md) `CVE-2026-27860` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 3.7 Low · Not analysed yet · Published 27 Mar 2026 · Tags: Other injection - [Spring AI has a Cypher Injection vulnerability in Neo4jVectorFilterExpressionConverter](https://agentprime.io/advisories/GHSA-7cj7-rcw6-p68v.md) `GHSA-7cj7-rcw6-p68v`, `CVE-2026-22743` · Maven `org.springframework.ai:spring-ai-neo4j-store`: affected `>=1.0.0-M5, <1.0.5 || >=1.1.0-M1, <1.1.4`, fixed in `1.0.5`, `1.1.4` · CVSS 7.5 High · Not analysed yet · Published 27 Mar 2026 · Tags: SQL injection, Other injection - [Spring AI Redis Store has TAG Field Query Injection Through Improper Neutralization of Special Characters](https://agentprime.io/advisories/GHSA-44f4-gvwj-6qg3.md) `GHSA-44f4-gvwj-6qg3`, `CVE-2026-22744` · Maven `org.springframework.ai:spring-ai-redis-store`: affected `>=1.0.0-M5, <1.0.5 || >=1.1.0-M1, <1.1.4`, fixed in `1.0.5`, `1.1.4` · CVSS 7.5 High · Not analysed yet · Published 27 Mar 2026 · Tags: Other injection - [Shenzhen Ruiming Technology Streamax Crocus Endpoint RemoteFormat.do sql injection](https://agentprime.io/advisories/CVE-2026-4910.md) `CVE-2026-4910` · CVE record: Shenzhen Ruiming Technology Streamax Crocus · CVSS 6.9 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: Other injection, SQL injection - [code-projects Simple Laundry System Parameter modstaffinfo.php sql injection](https://agentprime.io/advisories/CVE-2026-4908.md) `CVE-2026-4908` · CVE record: code-projects Simple Laundry System · CVSS 6.9 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: Other injection, SQL injection - [Nodemailer has SMTP command injection due to unsanitized \`envelope.size\` parameter](https://agentprime.io/advisories/GHSA-c7w3-x93f-qmm8.md) `GHSA-c7w3-x93f-qmm8`, `CVE-2026-82854` · npm `nodemailer`: affected `<8.0.4`, fixed in `8.0.4` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Mar 2026 · Tags: Other injection - [URL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API Key](https://agentprime.io/advisories/CVE-2026-33148.md) `CVE-2026-33148` · CVE record: TandoorRecipes recipes · CVSS 6.5 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Other injection - [n8n Vulnerable to LDAP Filter Injection in LDAP Node](https://agentprime.io/advisories/GHSA-w83q-mcmx-mh42.md) `GHSA-w83q-mcmx-mh42`, `CVE-2026-33751` · npm `n8n`: affected `<1.123.27 || >=2.0.0-rc.0, <2.13.3 || >=2.14.0, <2.14.1`, fixed in `1.123.27`, `2.13.3`, `2.14.1` · CVSS 6.3 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Other injection - [itsourcecode Free Hotel Reservation System index.php sql injection](https://agentprime.io/advisories/CVE-2026-4876.md) `CVE-2026-4876` · CVE record: itsourcecode Free Hotel Reservation System · CVSS 5.3 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Other injection, SQL injection - [HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability](https://agentprime.io/advisories/CVE-2025-55271.md) `CVE-2025-55271` · CVE record: HCL Aftermarket DPC · CVSS 3.1 Low · Not analysed yet · Published 26 Mar 2026 · Tags: Other injection - [code-projects Simple Laundry System Parameter checkregisitem.php sql injection](https://agentprime.io/advisories/CVE-2026-4850.md) `CVE-2026-4850` · CVE record: code-projects Simple Laundry System · CVSS 6.9 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Other injection, SQL injection - [code-projects Online Food Ordering System Admin Login admin.php sql injection](https://agentprime.io/advisories/CVE-2026-4844.md) `CVE-2026-4844` · CVE record: code-projects Online Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Enrollment System Parameter index.php sql injection](https://agentprime.io/advisories/CVE-2026-4842.md) `CVE-2026-4842` · CVE record: itsourcecode Online Enrollment System · CVSS 6.9 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Other injection, SQL injection - [code-projects Online Food Ordering System Shopping Cart cart.php sql injection](https://agentprime.io/advisories/CVE-2026-4841.md) `CVE-2026-4841` · CVE record: code-projects Online Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Food Ordering System Parameter purchase.php sql injection](https://agentprime.io/advisories/CVE-2026-4839.md) `CVE-2026-4839` · CVE record: SourceCodester Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Malawi Online Market display.php sql injection](https://agentprime.io/advisories/CVE-2026-4838.md) `CVE-2026-4838` · CVE record: SourceCodester Malawi Online Market · CVSS 6.9 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Other injection, SQL injection - [code-projects Accounting System delete.php sql injection](https://agentprime.io/advisories/CVE-2026-4836.md) `CVE-2026-4836` · CVE record: code-projects Accounting System · CVSS 5.3 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Sales and Inventory System HTTP GET Parameter update_stock.php sql injection](https://agentprime.io/advisories/CVE-2026-4826.md) `CVE-2026-4826` · CVE record: SourceCodester Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Sales and Inventory System HTTP GET Parameter update_sales.php sql injection](https://agentprime.io/advisories/CVE-2026-4825.md) `CVE-2026-4825` · CVE record: SourceCodester Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Other injection, SQL injection - [IBM Maximo Application Suite - Monitor Component uses Log Forging which is vulnerable to .](https://agentprime.io/advisories/CVE-2025-14684.md) `CVE-2025-14684` · CVE record: IBM Maximo Application Suite - Monitor Component · CVSS 4.0 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Other injection - [CRLF injection in Cisco IOS XE Software](https://agentprime.io/advisories/CVE-2026-20113.md) `CVE-2026-20113` · CVE record: Cisco Cisco IOS XE Software · CVSS 5.3 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Other injection - [code-projects Simple Laundry System Parameter checkcheckout.php sql injection](https://agentprime.io/advisories/CVE-2026-4784.md) `CVE-2026-4784` · CVE record: code-projects Simple Laundry System · CVSS 6.9 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Other injection, SQL injection - [itsourcecode College Management System Parameter add-single-student-results.php sql injection](https://agentprime.io/advisories/CVE-2026-4783.md) `CVE-2026-4783` · CVE record: itsourcecode College Management System · CVSS 5.3 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Sales and Inventory System HTTP GET Parameter update_purchase.php sql injection](https://agentprime.io/advisories/CVE-2026-4781.md) `CVE-2026-4781` · CVE record: SourceCodester Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Sales and Inventory System HTTP GET Parameter update_out_standing.php sql injection](https://agentprime.io/advisories/CVE-2026-4780.md) `CVE-2026-4780` · CVE record: SourceCodester Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Sales and Inventory System HTTP GET Parameter update_customer_details.php sql injection](https://agentprime.io/advisories/CVE-2026-4779.md) `CVE-2026-4779` · CVE record: SourceCodester Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Sales and Inventory System HTTP GET Parameter update_category.php sql injection](https://agentprime.io/advisories/CVE-2026-4778.md) `CVE-2026-4778` · CVE record: SourceCodester Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Sales and Inventory System POST Parameter view_supplier.php sql injection](https://agentprime.io/advisories/CVE-2026-4777.md) `CVE-2026-4777` · CVE record: SourceCodester Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Other injection, SQL injection - [iCalendar has ICS injection via unsanitized URI property values](https://agentprime.io/advisories/GHSA-pv9c-9mfh-hvxq.md) `GHSA-pv9c-9mfh-hvxq`, `CVE-2026-33635` · RubyGems `icalendar`: affected `>=2.0.0, <2.12.2`, fixed in `2.12.2` · CVSS 4.3 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Other injection - [Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API](https://agentprime.io/advisories/GHSA-x6w6-2xwp-3jh6.md) `GHSA-x6w6-2xwp-3jh6`, `CVE-2026-30932`, `PKSA-8kv2-v86v-pjxv` · Packagist `froxlor/froxlor`: affected `<2.3.5`, fixed in `2.3.5` · CVSS 8.6 High · Not analysed yet · Published 24 Mar 2026 · Tags: Other injection - [NGINX ngx_mail_proxy_module vulnerability](https://agentprime.io/advisories/CVE-2026-28753.md) `CVE-2026-28753` · CVE record: F5 NGINX Open Source and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Other injection - [Langflow GitHub Actions Shell Injection](https://agentprime.io/advisories/CVE-2026-33475.md) `CVE-2026-33475` · CVE record: langflow-ai langflow · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: Other injection, Command injection - [itsourcecode Online Enrollment System Parameter index.php sql injection](https://agentprime.io/advisories/CVE-2026-4632.md) `CVE-2026-4632` · CVE record: itsourcecode Online Enrollment System · CVSS 6.9 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Admission System programmes.php sql injection](https://agentprime.io/advisories/CVE-2026-4625.md) `CVE-2026-4625` · CVE record: SourceCodester Online Admission System · CVSS 6.9 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Other injection, SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .