# Other injection.

LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [kishor-23 food-waste-management-system Order Assignment Block admin.php sql injection](https://agentprime.io/advisories/CVE-2026-105168.md)
  `CVE-2026-105168` · CVE record: kishor-23 food-waste-management-system · CVSS 5.3 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Other injection, SQL injection
- [kishor-23 food-waste-management-system donate.php sql injection](https://agentprime.io/advisories/CVE-2026-105167.md)
  `CVE-2026-105167` · CVE record: kishor-23 food-waste-management-system · CVSS 6.9 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Other injection, SQL injection
- [kishor-23 food-waste-management-system Food Donation Form fooddonateform.php insert sql injection](https://agentprime.io/advisories/CVE-2026-105166.md)
  `CVE-2026-105166` · CVE record: kishor-23 food-waste-management-system · CVSS 6.9 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Other injection, SQL injection
- [RainyGao DocSys Database Management BaseController.java BaseController.createDBForMysql sql injection](https://agentprime.io/advisories/CVE-2026-105158.md)
  `CVE-2026-105158` · CVE record: RainyGao DocSys · CVSS 6.9 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Other injection, SQL injection
- [mooSocial all-products sql injection](https://agentprime.io/advisories/CVE-2026-105149.md)
  `CVE-2026-105149` · CVE record: mooSocial · CVSS 6.9 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Other injection, SQL injection
- [Comsenz Discuz! Admin Medal Moderation mod.php modmedalsubmit sql injection](https://agentprime.io/advisories/CVE-2026-105146.md)
  `CVE-2026-105146` · CVE record: Comsenz Discuz! · CVSS 5.1 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Other injection, SQL injection
- [InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection](https://agentprime.io/advisories/CVE-2026-105135.md)
  `CVE-2026-105135` · CVE record: InternLM MindSearch · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Other injection, Code injection
- [All in One SEO < 5.0.2.1 - Unauthenticated Arbitrary Shortcode Execution via Search Query](https://agentprime.io/advisories/CVE-2026-19856.md)
  `CVE-2026-19856` · CVE record: Unknown All in One SEO · CVSS 6.5 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Other injection
- [CodeAstro Simple Loan Management System index.php sql injection](https://agentprime.io/advisories/CVE-2026-104625.md)
  `CVE-2026-104625` · CVE record: CodeAstro Simple Loan Management System · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Other injection, SQL injection
- [CodeAstro Simple Pharmacy Management System delete.php sql injection](https://agentprime.io/advisories/CVE-2026-104614.md)
  `CVE-2026-104614` · CVE record: CodeAstro Simple Pharmacy Management System · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Other injection, SQL injection
- [CodeAstro Simple Pharmacy Management System view.php sql injection](https://agentprime.io/advisories/CVE-2026-104613.md)
  `CVE-2026-104613` · CVE record: CodeAstro Simple Pharmacy Management System · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Other injection, SQL injection
- [onetwothreeneth HospitalManagementSystem edit_accounts.php get sql injection](https://agentprime.io/advisories/CVE-2026-104609.md)
  `CVE-2026-104609` · CVE record: onetwothreeneth HospitalManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Other injection, SQL injection
- [itsourcecode Online Admission System Project confirm.php sql injection](https://agentprime.io/advisories/CVE-2026-104606.md)
  `CVE-2026-104606` · CVE record: itsourcecode Online Admission System Project · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Other injection, SQL injection
- [Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbitrary Shortcode Execution via get_addon_output_data](https://agentprime.io/advisories/CVE-2026-92924.md)
  `CVE-2026-92924` · CVE record: Unknown Unlimited Elements for Elementor · CVSS 5.4 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Other injection
- [The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' Parameter](https://agentprime.io/advisories/CVE-2026-84740.md)
  `CVE-2026-84740` · CVE record: Unknown The Events Calendar · CVSS 6.5 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Other injection
- [SourceCodester Online Reviewer Management System btn_functions.php activity sql injection](https://agentprime.io/advisories/CVE-2026-104123.md)
  `CVE-2026-104123` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Other injection, SQL injection
- [itsourcecode Pet Shop Management System admin_reservefilter.php sql injection](https://agentprime.io/advisories/CVE-2026-104053.md)
  `CVE-2026-104053` · CVE record: itsourcecode Pet Shop Management System · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Other injection, SQL injection
- [itsourcecode Pet Shop Management System admin_reject_completed.php sql injection](https://agentprime.io/advisories/CVE-2026-104052.md)
  `CVE-2026-104052` · CVE record: itsourcecode Pet Shop Management System · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Other injection, SQL injection
- [djehuty: Unauthenticated SPARQL injection in the search API (\`order\`, \`operator\`, \`key\`)](https://agentprime.io/advisories/CVE-2026-73976.md)
  `CVE-2026-73976` · CVE record: 4TUResearchData djehuty · CVSS 7.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Other injection
- [djehuty: Authenticated SPARQL injection in session editing allows writing arbitrary RDF triples](https://agentprime.io/advisories/CVE-2026-73975.md)
  `CVE-2026-73975` · CVE record: 4TUResearchData djehuty · CVSS 8.4 High · Not analysed yet · Published 1 Oct 2026 · Tags: Other injection
- [itsourcecode Leave Management System controller.php sql injection](https://agentprime.io/advisories/CVE-2026-103690.md)
  `CVE-2026-103690` · CVE record: itsourcecode Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Other injection, SQL injection
- [n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation](https://agentprime.io/advisories/CVE-2026-103258.md)
  `CVE-2026-103258` · CVE record: n8n-io n8n · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Other injection
- [n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory](https://agentprime.io/advisories/CVE-2026-103250.md)
  `CVE-2026-103250` · CVE record: n8n-io n8n · CVSS 7.0 High · Not analysed yet · Published 1 Oct 2026 · Tags: Other injection
- [itsourcecode Leave Management System controller.php sql injection](https://agentprime.io/advisories/CVE-2026-103543.md)
  `CVE-2026-103543` · CVE record: itsourcecode Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Other injection, SQL injection
- [virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection](https://agentprime.io/advisories/GHSA-9h9j-4vrj-gf7g.md)
  `GHSA-9h9j-4vrj-gf7g`, `BIT-virtualenv-2026-102938`, `CVE-2026-102938`, `PYSEC-2026-4012` · PyPI `virtualenv`: affected `<21.7.11`, fixed in `21.7.11` · CVSS 5.8 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection
- [Kiteworks Email Protection Gateway Path Traversal](https://agentprime.io/advisories/CVE-2026-102116.md)
  `CVE-2026-102116` · CVE record: Kiteworks Email Protection Gateway · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal, Other injection
- [Kiteworks Core Command Execution through Configuration Injection](https://agentprime.io/advisories/CVE-2026-102136.md)
  `CVE-2026-102136` · CVE record: Kiteworks Core · CVSS 6.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection
- [Kiteworks Core Server-Side Request Forgery through CRLF Injection](https://agentprime.io/advisories/CVE-2026-102145.md)
  `CVE-2026-102145` · CVE record: Kiteworks Core · CVSS 6.6 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection
- [AdithyaYelloju Restaurant-Management-System table_booking.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-103232.md)
  `CVE-2026-103232` · CVE record: AdithyaYelloju Restaurant-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [AdithyaYelloju Restaurant-Management-System Order Cancellation cancel.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-103231.md)
  `CVE-2026-103231` · CVE record: AdithyaYelloju Restaurant-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [Axios: Header Injection via Inherited headers After Minimal Interceptor](https://agentprime.io/advisories/GHSA-j8rh-479h-cp32.md)
  `GHSA-j8rh-479h-cp32`, `CVE-2026-101904` · npm `axios`: affected `>=1.0.0, <1.20.0`, fixed in `1.20.0` · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, Prototype pollution
- [Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders](https://agentprime.io/advisories/GHSA-4hqw-qxg8-jxx2.md)
  `GHSA-4hqw-qxg8-jxx2`, `CVE-2026-101900` · npm `axios`: affected `>=1.12.0, <1.20.0`, fixed in `1.20.0` · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, Prototype pollution, CWE-693
- [AdithyaYelloju Restaurant-Management-System Order Placement ord.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-103230.md)
  `CVE-2026-103230` · CVE record: AdithyaYelloju Restaurant-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [AdithyaYelloju Restaurant-Management-System Unauthenticated Action Script delete1.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-103229.md)
  `CVE-2026-103229` · CVE record: AdithyaYelloju Restaurant-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection](https://agentprime.io/advisories/CVE-2026-103117.md)
  `CVE-2026-103117` · CVE record: OS4ED openSIS-Classic · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [OS4ED openSIS-Classic Student List Search Endpoint GetStuListFnc.php DBQuery sql injection](https://agentprime.io/advisories/CVE-2026-103116.md)
  `CVE-2026-103116` · CVE record: OS4ED openSIS-Classic · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [OS4ED openSIS-Classic Student Search CustomFieldsFnc.php sql injection](https://agentprime.io/advisories/CVE-2026-103115.md)
  `CVE-2026-103115` · CVE record: OS4ED openSIS-Classic · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [OS4ED openSIS-Classic Assignment Management Endpoint Assignments.php DBQuery_assignment sql injection](https://agentprime.io/advisories/CVE-2026-103114.md)
  `CVE-2026-103114` · CVE record: OS4ED openSIS-Classic · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [OS4ED openSIS-Classic General Information Tab Student.php save action sql injection](https://agentprime.io/advisories/CVE-2026-103113.md)
  `CVE-2026-103113` · CVE record: OS4ED openSIS-Classic · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [Apache MINA SSHD: LDAP injection in sshd-ldap](https://agentprime.io/advisories/CVE-2026-94053.md)
  `CVE-2026-94053` · CVE record: Apache Software Foundation Apache MINA SSHD · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, CWE-305
- [SourceCodester Car Driving School Management System Master.php save_enrollment sql injection](https://agentprime.io/advisories/CVE-2026-102913.md)
  `CVE-2026-102913` · CVE record: SourceCodester Car Driving School Management System · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [SourceCodester Online Leave Management System page reports sql injection](https://agentprime.io/advisories/CVE-2026-102912.md)
  `CVE-2026-102912` · CVE record: SourceCodester Online Leave Management System · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [SourceCodester Online Reviewer Management System exam-delete.php sql injection](https://agentprime.io/advisories/CVE-2026-102910.md)
  `CVE-2026-102910` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [SourceCodester Online Reviewer Management System btn_functions.php sql injection](https://agentprime.io/advisories/CVE-2026-102909.md)
  `CVE-2026-102909` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [SourceCodester Online Reviewer Management System questions-view.php sql injection](https://agentprime.io/advisories/CVE-2026-102908.md)
  `CVE-2026-102908` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [Ziroom ZHOME A0101 ping command injection](https://agentprime.io/advisories/CVE-2026-102794.md)
  `CVE-2026-102794` · CVE record: Ziroom ZHOME A0101 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Other injection, Command injection
- [Ziroom ZHOME A0101 set_time_zone command injection](https://agentprime.io/advisories/CVE-2026-102793.md)
  `CVE-2026-102793` · CVE record: Ziroom ZHOME A0101 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Other injection, Command injection
- [EasyTimeline should not serve image maps as application/xml](https://agentprime.io/advisories/CVE-2026-103044.md)
  `CVE-2026-103044` · CVE record: The Wikimedia Foundation Mediawiki - EasyTimeline extension · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal, Other injection
- [Ziroom ZHOME A0101 set_syslog command injection](https://agentprime.io/advisories/CVE-2026-102792.md)
  `CVE-2026-102792` · CVE record: Ziroom ZHOME A0101 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Other injection, Command injection
- [risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection](https://agentprime.io/advisories/CVE-2026-102616.md)
  `CVE-2026-102616` · CVE record: risesoft-y9 WorkFlow-Engine · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Other injection, SQL injection
- [mahonelau kykms SqlInjectionUtil QueryGenerator.java QueryGenerator.doMultiFieldsOrder sql injection](https://agentprime.io/advisories/CVE-2026-102491.md)
  `CVE-2026-102491` · CVE record: mahonelau kykms · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Other injection, SQL injection
- [TIBCO Administrator Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-4034.md)
  `CVE-2026-4034` · CVE record: Tibco Administrator · CVSS 8.7 High · Not analysed yet · Published 29 Sept 2026 · Tags: Other injection
- [Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox](https://agentprime.io/advisories/CVE-2026-82973.md)
  `CVE-2026-82973` · CVE record: psyb0t docker-mailbox · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Other injection
- [Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that ...](https://agentprime.io/advisories/PYSEC-2026-4187.md)
  `PYSEC-2026-4187`, `CVE-2026-81914` · PyPI `apache-airflow-providers-google`: affected `<22.6.0`, fixed in `22.6.0` · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Other injection
- [MODSetter SurfSense MCP Connector Integration test command injection](https://agentprime.io/advisories/CVE-2026-102243.md)
  `CVE-2026-102243` · CVE record: MODSetter SurfSense · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Other injection, Command injection
- [Ziroom ZHOME A0101 set_passwd command injection](https://agentprime.io/advisories/CVE-2026-101264.md)
  `CVE-2026-101264` · CVE record: Ziroom ZHOME A0101 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, Command injection
- [Ziroom ZHOME A0101 set_online_client command injection](https://agentprime.io/advisories/CVE-2026-101263.md)
  `CVE-2026-101263` · CVE record: Ziroom ZHOME A0101 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, Command injection
- [Ziroom ZHOME A0101 set_online_client command injection](https://agentprime.io/advisories/CVE-2026-101262.md)
  `CVE-2026-101262` · CVE record: Ziroom ZHOME A0101 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, Command injection
- [Ziroom ZHOME A0101 firstSetup_wifi command injection](https://agentprime.io/advisories/CVE-2026-101261.md)
  `CVE-2026-101261` · CVE record: Ziroom ZHOME A0101 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, Command injection
- [Ziroom ZHOME A0101 firstLogin command injection](https://agentprime.io/advisories/CVE-2026-101260.md)
  `CVE-2026-101260` · CVE record: Ziroom ZHOME A0101 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, Command injection

Newest: <https://agentprime.io/advisories/tag/injection.md>
Older: <https://agentprime.io/advisories/tag/injection.md?cursor=WyIyMDI2LTA5LTI4VDIyOjE1OjEwLjU3MTAwMFoiLCJDVkUtMjAyNi0xMDEyNjAiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=injection&cursor=WyIyMDI2LTEwLTA0VDIzOjE1OjExLjU1NTAwMFoiLCJDVkUtMjAyNi0xMDUxNjkiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/injection/?cursor=WyIyMDI2LTEwLTA0VDIzOjE1OjExLjU1NTAwMFoiLCJDVkUtMjAyNi0xMDUxNjkiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.