# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Ghost: Invite Token Disclosure in Ghost Admin API](https://agentprime.io/advisories/GHSA-v6q3-xqxm-6f5v.md) `GHSA-v6q3-xqxm-6f5v`, `BIT-ghost-2026-104416`, `BIT-ghost-2026-105675`, `CVE-2026-104416`, `CVE-2026-105675` · npm `ghost`: affected `>=4.39.0, <6.64.0`, fixed in `6.64.0` · CVSS 7.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure, Other injection - [Cisco Meraki Security Hardening Release October 2026 - Improper Neutralization of Special Elements Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76472.md) `CVE-2026-76472` · CVE record: Cisco Cisco Campus Gateway Software and 3 more · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: Other injection - [Ghost: Authorization Bypass in Comments Feature](https://agentprime.io/advisories/GHSA-6q6j-f24j-p477.md) `GHSA-6q6j-f24j-p477`, `BIT-ghost-2026-103289`, `BIT-ghost-2026-105681`, `CVE-2026-103289`, `CVE-2026-105681` · npm `ghost`: affected `>=5.9.0, <6.44.1`, fixed in `6.44.1` · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Other injection - [MetForm < 4.3.1 - Unauthenticated HTML Injection in Notification Emails via Field Shortcodes](https://agentprime.io/advisories/CVE-2026-86833.md) `CVE-2026-86833` · CVE record: Unknown MetForm · CVSS 5.4 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Other injection - [An HTTP header injection vulnerability was found in the ADM](https://agentprime.io/advisories/CVE-2026-105324.md) `CVE-2026-105324` · CVE record: ASUSTOR Inc. ADM · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Other injection - [Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields](https://agentprime.io/advisories/GHSA-prpw-wwv7-xjjr.md) `GHSA-prpw-wwv7-xjjr`, `CVE-2026-41504`, `GO-2026-6669` · Go `github.com/corazawaf/coraza/v3`: affected `>=3.0.0, <3.8.0`, fixed in `3.8.0` · CVSS 5.8 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection - [Security Advisory 0191](https://agentprime.io/advisories/CVE-2026-102156.md) `CVE-2026-102156` · CVE record: Arista Networks CloudVision CUE · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection - [Security Advisory 0190](https://agentprime.io/advisories/CVE-2026-102158.md) `CVE-2026-102158` · CVE record: Arista Networks CloudVision CUE · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection - [MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS](https://agentprime.io/advisories/CVE-2026-106512.md) `CVE-2026-106512` · CVE record: MISP sachertortephp · CVSS 8.4 High · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS), Other injection, CWE-20 - [SourceCodester Performance Indicator System view_product.php sql injection](https://agentprime.io/advisories/CVE-2026-105957.md) `CVE-2026-105957` · CVE record: SourceCodester Performance Indicator System · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection, SQL injection - [i18next-http-backend incomplete URL validation permits SSRF](https://agentprime.io/advisories/GHSA-xvq9-wjp8-hwqf.md) `GHSA-xvq9-wjp8-hwqf`, `CVE-2026-105800` · npm `i18next-http-backend`: affected `<4.0.2`, fixed in `4.0.2` · CVSS 3.7 Low · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection, Server-side request forgery (SSRF) - [LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values](https://agentprime.io/advisories/GHSA-5x6v-p487-7qh2.md) `GHSA-5x6v-p487-7qh2`, `CVE-2026-105799` · npm `@langchain/redis`: affected `<1.1.1`, fixed in `1.1.1` · CVSS 2.3 Low · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection - [Kusalkasilva Learning-Management-System search_class.php sql injection](https://agentprime.io/advisories/CVE-2026-105921.md) `CVE-2026-105921` · CVE record: Kusalkasilva Learning-Management-System · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection, SQL injection - [Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection](https://agentprime.io/advisories/CVE-2026-105920.md) `CVE-2026-105920` · CVE record: Kusalkasilva Learning-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection, SQL injection - [Kusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection](https://agentprime.io/advisories/CVE-2026-105919.md) `CVE-2026-105919` · CVE record: Kusalkasilva Learning-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection, SQL injection - [Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection](https://agentprime.io/advisories/CVE-2026-105918.md) `CVE-2026-105918` · CVE record: Kusalkasilva Learning-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Simple Student Information System searchquery.php sql injection](https://agentprime.io/advisories/CVE-2026-105807.md) `CVE-2026-105807` · CVE record: SourceCodester Simple Student Information System · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection, SQL injection - [bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL admin_transaction.php sql injection](https://agentprime.io/advisories/CVE-2026-105776.md) `CVE-2026-105776` · CVE record: bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection, SQL injection - [girishsaraf Online-Appointment-Booking-System Booking book.php sql injection](https://agentprime.io/advisories/CVE-2026-105472.md) `CVE-2026-105472` · CVE record: girishsaraf Online-Appointment-Booking-System · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection, SQL injection - [pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods](https://agentprime.io/advisories/GHSA-8fvv-fgr5-f8ch.md) `GHSA-8fvv-fgr5-f8ch`, `CVE-2026-88029`, `PYSEC-2026-4294` · PyPI `pymongo`: affected `<4.18.1`, fixed in `4.18.1` · CVSS 6.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection - [MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs](https://agentprime.io/advisories/GHSA-8fxw-fmj8-xp7j.md) `GHSA-8fxw-fmj8-xp7j`, `CVE-2026-88023`, `PKSA-y93m-jgy6-r9ns` · Packagist `mongodb/mongodb`: affected `>=1.1.0, <1.24.5 || >=2.0.0, <2.4.2`, fixed in `1.24.5`, `2.4.2` · CVSS 6.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection - [girishsaraf Online-Appointment-Booking-System Registration signup.php sql injection](https://agentprime.io/advisories/CVE-2026-105471.md) `CVE-2026-105471` · CVE record: girishsaraf Online-Appointment-Booking-System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [CVE-2026-82989](https://agentprime.io/advisories/CVE-2026-82989.md) `CVE-2026-82989` · CVE record: Viewsonic vCast · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, CWE-147 - [@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name](https://agentprime.io/advisories/GHSA-gxm5-99cw-xjw9.md) `GHSA-gxm5-99cw-xjw9`, `CVE-2026-74866` · npm `@fastify/busboy`: affected `<3.2.2`, fixed in `3.2.2` · CVSS 5.8 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection - [Langflow: Prompt injection in Langflow Smart Transform can lead to code execution](https://agentprime.io/advisories/GHSA-9fpm-3445-2vx4.md) `GHSA-9fpm-3445-2vx4`, `CVE-2026-7700`, `PYSEC-2026-4232` · PyPI `langflow`: affected `>=1.3.0, <1.10.3`, fixed in `1.10.3` · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, Code injection - [girishsaraf Online-Appointment-Booking-System Doctor Search Endpoint locateus.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-105470.md) `CVE-2026-105470` · CVE record: girishsaraf Online-Appointment-Booking-System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [girishsaraf Online-Appointment-Booking-System AJAX Endpoint get_town.php sql injection](https://agentprime.io/advisories/CVE-2026-105469.md) `CVE-2026-105469` · CVE record: girishsaraf Online-Appointment-Booking-System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [girishsaraf Online-Appointment-Booking-System Login mlogin.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-105468.md) `CVE-2026-105468` · CVE record: girishsaraf Online-Appointment-Booking-System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [feelec-yishu feelcrm-os Member Endpoint MemberController.class.php index sql injection](https://agentprime.io/advisories/CVE-2026-105388.md) `CVE-2026-105388` · CVE record: feelec-yishu feelcrm-os · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [girishsaraf Online-Appointment-Booking-System Patient Login cover.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-105387.md) `CVE-2026-105387` · CVE record: girishsaraf Online-Appointment-Booking-System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [onetwothreeneth HospitalManagementSystem print.php get sql injection](https://agentprime.io/advisories/CVE-2026-105386.md) `CVE-2026-105386` · CVE record: onetwothreeneth HospitalManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [onetwothreeneth HospitalManagementSystem transaction_details.php sql injection](https://agentprime.io/advisories/CVE-2026-105385.md) `CVE-2026-105385` · CVE record: onetwothreeneth HospitalManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [UNION HospitalManagementSystem patient_info.php sql injection](https://agentprime.io/advisories/CVE-2026-105384.md) `CVE-2026-105384` · CVE record: UNION HospitalManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [onetwothreeneth HospitalManagementSystem controller.php sql injection](https://agentprime.io/advisories/CVE-2026-105383.md) `CVE-2026-105383` · CVE record: onetwothreeneth HospitalManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [Plane: Unauthenticated ORM field-name injection via \`group_by\`/\`sub_group_by\` on public deploy boards (DoS + blind oracle)](https://agentprime.io/advisories/CVE-2026-104956.md) `CVE-2026-104956` · CVE record: makeplane plane · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection - [TallCMS PluginManager ThemeManager.php code injection](https://agentprime.io/advisories/CVE-2026-105329.md) `CVE-2026-105329` · CVE record: TallCMS · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, Code injection - [feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql injection](https://agentprime.io/advisories/CVE-2026-105287.md) `CVE-2026-105287` · CVE record: feelec-yishu feelcrm-os · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Admission System schoolyear.php sql injection](https://agentprime.io/advisories/CVE-2026-105254.md) `CVE-2026-105254` · CVE record: itsourcecode Online Admission System · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Admission System Project login1.php sql injection](https://agentprime.io/advisories/CVE-2026-105253.md) `CVE-2026-105253` · CVE record: itsourcecode Online Admission System Project · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Reviewer Management System btn_functions.php course sql injection](https://agentprime.io/advisories/CVE-2026-105247.md) `CVE-2026-105247` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Reviewer Management System btn_functions.php update sql injection](https://agentprime.io/advisories/CVE-2026-105246.md) `CVE-2026-105246` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [kishor-23 food-waste-management-system Registration deliverysignup.php sql injection](https://agentprime.io/advisories/CVE-2026-105232.md) `CVE-2026-105232` · CVE record: kishor-23 food-waste-management-system · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [kishor-23 food-waste-management-system Admin Registration signup.php sql injection](https://agentprime.io/advisories/CVE-2026-105231.md) `CVE-2026-105231` · CVE record: kishor-23 food-waste-management-system · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [kishor-23 food-waste-management-system deliverymyord.php sql injection](https://agentprime.io/advisories/CVE-2026-105230.md) `CVE-2026-105230` · CVE record: kishor-23 food-waste-management-system · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [kishor-23 food-waste-management-system User Registration Endpoint signup.php sql injection](https://agentprime.io/advisories/CVE-2026-105229.md) `CVE-2026-105229` · CVE record: kishor-23 food-waste-management-system · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [osCommerce osCommerce2 Newsletter Management newsletters.php include code injection](https://agentprime.io/advisories/CVE-2026-105226.md) `CVE-2026-105226` · CVE record: osCommerce osCommerce2 · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, Code injection - [osCommerce osCommerce2 Payment payment.php include code injection](https://agentprime.io/advisories/CVE-2026-105225.md) `CVE-2026-105225` · CVE record: osCommerce osCommerce2 · CVSS 4.8 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, Code injection - [itsourcecode Online Admission System key.php sql injection](https://agentprime.io/advisories/CVE-2026-105187.md) `CVE-2026-105187` · CVE record: itsourcecode Online Admission System · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Admission System new.php sql injection](https://agentprime.io/advisories/CVE-2026-105186.md) `CVE-2026-105186` · CVE record: itsourcecode Online Admission System · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Admission System examinee.php sql injection](https://agentprime.io/advisories/CVE-2026-105185.md) `CVE-2026-105185` · CVE record: itsourcecode Online Admission System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Admission System creteria.php sql injection](https://agentprime.io/advisories/CVE-2026-105184.md) `CVE-2026-105184` · CVE record: itsourcecode Online Admission System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Admission System confirm.php sql injection](https://agentprime.io/advisories/CVE-2026-105183.md) `CVE-2026-105183` · CVE record: itsourcecode Online Admission System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Reviewer Management System btn_functions.php update sql injection](https://agentprime.io/advisories/CVE-2026-105182.md) `CVE-2026-105182` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Admission System register1.php sql injection](https://agentprime.io/advisories/CVE-2026-105181.md) `CVE-2026-105181` · CVE record: itsourcecode Online Admission System · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Drug Recommendation System Symptom Creation add_symptom.php mysqli_real_escape_string sql injection](https://agentprime.io/advisories/CVE-2026-105178.md) `CVE-2026-105178` · CVE record: SourceCodester Drug Recommendation System · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Drug Recommendation System Drug Creation add_drug.php sql injection](https://agentprime.io/advisories/CVE-2026-105177.md) `CVE-2026-105177` · CVE record: SourceCodester Drug Recommendation System · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Drug Recommendation System edit_class.php sql injection](https://agentprime.io/advisories/CVE-2026-105176.md) `CVE-2026-105176` · CVE record: SourceCodester Drug Recommendation System · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Drug Recommendation System Student Registration add_student.php sql injection](https://agentprime.io/advisories/CVE-2026-105175.md) `CVE-2026-105175` · CVE record: SourceCodester Drug Recommendation System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Admission System login1.php sql injection](https://agentprime.io/advisories/CVE-2026-105172.md) `CVE-2026-105172` · CVE record: itsourcecode Online Admission System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [kishor-23 food-waste-management-system Take Order delivery.php sql injection](https://agentprime.io/advisories/CVE-2026-105169.md) `CVE-2026-105169` · CVE record: kishor-23 food-waste-management-system · CVSS 6.9 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Other injection, SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .