# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting](https://agentprime.io/advisories/CVE-2026-91831.md) `CVE-2026-91831` · CVE record: Unknown Subscribe to Comments · CVSS 3.8 Low · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection - [Dav-ee dairy-management-system delete.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-112089.md) `CVE-2026-112089` · CVE record: Dav-ee dairy-management-system · CVSS 5.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, SQL injection - [Dav-ee dairy-management-system add.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-112088.md) `CVE-2026-112088` · CVE record: Dav-ee dairy-management-system · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Cake Ordering System confirm.php sql injection](https://agentprime.io/advisories/CVE-2026-112087.md) `CVE-2026-112087` · CVE record: itsourcecode Online Cake Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, SQL injection - [LlamaChinese Llama-Chinese Adapter Config chat_gradio_no_merge.py get_class_from_dynamic_module code injection](https://agentprime.io/advisories/CVE-2026-112080.md) `CVE-2026-112080` · CVE record: LlamaChinese Llama-Chinese · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, Code injection - [RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info\_ code injection](https://agentprime.io/advisories/CVE-2026-112078.md) `CVE-2026-112078` · CVE record: RVC-Project Retrieval-based-Voice-Conversion-WebUI · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, Code injection - [aircheng-org iWebShop-5 util.php search sql injection](https://agentprime.io/advisories/CVE-2026-112032.md) `CVE-2026-112032` · CVE record: aircheng-org iWebShop-5 · CVSS 5.1 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Other injection, SQL injection - [itsmeravitejak Online-Examination-System Exam exam.php startExam sql injection](https://agentprime.io/advisories/CVE-2026-111992.md) `CVE-2026-111992` · CVE record: itsmeravitejak Online-Examination-System · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Other injection, SQL injection - [WongKinYiu yolov9 ONNX Metadata common.py DetectMultiBackend.\_\_init\_\_ code injection](https://agentprime.io/advisories/CVE-2026-111991.md) `CVE-2026-111991` · CVE record: WongKinYiu yolov9 · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Other injection, Code injection - [kishan0725 Hospital Management System Appointment Cancellation admin-panel.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-111990.md) `CVE-2026-111990` · CVE record: kishan0725 Hospital Management System · CVSS 6.9 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Other injection, SQL injection - [AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection](https://agentprime.io/advisories/CVE-2026-111986.md) `CVE-2026-111986` · CVE record: AUTOMATIC1111 stable-diffusion-webui · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Other injection, Code injection - [alexpasmantier television entry.rs output command injection](https://agentprime.io/advisories/CVE-2026-111876.md) `CVE-2026-111876` · CVE record: alexpasmantier television · CVSS 4.8 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Other injection, Command injection - [itsmeravitejak Online-Examination-System AJAX Endpoint exammanger.php topicslist sql injection](https://agentprime.io/advisories/CVE-2026-111873.md) `CVE-2026-111873` · CVE record: itsmeravitejak Online-Examination-System · CVSS 6.9 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Other injection, SQL injection - [itsmeravitejak Online-Examination-System database.php getreport sql injection](https://agentprime.io/advisories/CVE-2026-111872.md) `CVE-2026-111872` · CVE record: itsmeravitejak Online-Examination-System · CVSS 6.9 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Other injection, SQL injection - [itsmeravitejak Online-Examination-System subjectsdb.php sql injection](https://agentprime.io/advisories/CVE-2026-111871.md) `CVE-2026-111871` · CVE record: itsmeravitejak Online-Examination-System · CVSS 6.9 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Other injection, SQL injection - [nemoTyrant manong func.php arr2sql sql injection](https://agentprime.io/advisories/CVE-2026-111866.md) `CVE-2026-111866` · CVE record: nemoTyrant manong · CVSS 6.9 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Other injection, SQL injection - [Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes](https://agentprime.io/advisories/CVE-2026-59962.md) `CVE-2026-59962` · CVE record: TandoorRecipes recipes · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Other injection - [Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php](https://agentprime.io/advisories/CVE-2026-111228.md) `CVE-2026-111228` · CVE record: Netgate pfSense CE · CVSS 5.1 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection - [Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php](https://agentprime.io/advisories/CVE-2026-111227.md) `CVE-2026-111227` · CVE record: Netgate pfSense CE · CVSS 5.1 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection - [Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner](https://agentprime.io/advisories/CVE-2026-111223.md) `CVE-2026-111223` · CVE record: Netgate pfSense CE · CVSS 8.6 High · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection - [Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting](https://agentprime.io/advisories/CVE-2026-111222.md) `CVE-2026-111222` · CVE record: Netgate pfSense CE · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection - [Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid](https://agentprime.io/advisories/CVE-2026-111220.md) `CVE-2026-111220` · CVE record: Netgate pfSense CE · CVSS 8.6 High · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection - [Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username](https://agentprime.io/advisories/CVE-2026-111219.md) `CVE-2026-111219` · CVE record: Netgate pfSense CE · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection - [CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip](https://agentprime.io/advisories/CVE-2026-55453.md) `CVE-2026-55453` · CVE record: OpenPrinting cups · CVSS 3.3 Low · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection, Command injection - [CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)](https://agentprime.io/advisories/CVE-2026-55467.md) `CVE-2026-55467` · CVE record: OpenPrinting cups · CVSS 2.5 Low · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection, Code injection, CWE-150 - [OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking](https://agentprime.io/advisories/CVE-2026-63442.md) `CVE-2026-63442` · CVE record: opnsense core · CVSS 8.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection - [OPNsense: XPath injection in MVC safe-delete](https://agentprime.io/advisories/CVE-2026-58395.md) `CVE-2026-58395` · CVE record: opnsense core · CVSS 4.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection - [OPNsense: XPATH Injection can disclose any secret in config.xml](https://agentprime.io/advisories/CVE-2026-53582.md) `CVE-2026-53582` · CVE record: opnsense core · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection - [EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export](https://agentprime.io/advisories/CVE-2026-55154.md) `CVE-2026-55154` · CVE record: espocrm espocrm · CVSS 5.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection - [MDX and SOAP Injection in Kendo UI for jQuery](https://agentprime.io/advisories/CVE-2026-108116.md) `CVE-2026-108116` · CVE record: Progress Software Kendo UI for jQuery · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection - [Injection in Eclipse Foundation Eclipse Jetty](https://agentprime.io/advisories/CVE-2026-76182.md) `CVE-2026-76182` · CVE record: Eclipse Foundation Eclipse Jetty · CVSS 6.9 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection - [Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter](https://agentprime.io/advisories/CVE-2026-81534.md) `CVE-2026-81534` · CVE record: ThemeHigh Email Customizer for WooCommerce (Pro) · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection - [FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token](https://agentprime.io/advisories/CVE-2026-110835.md) `CVE-2026-110835` · CVE record: FreeRDP FreeRDP · CVSS 6.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Other injection - [cemtan sar2html Archive Processing sar2html.py updateDb sql injection](https://agentprime.io/advisories/CVE-2026-110670.md) `CVE-2026-110670` · CVE record: cemtan sar2html · CVSS 6.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Other injection, SQL injection - [cemtan sar2html sar2html.py index sql injection](https://agentprime.io/advisories/CVE-2026-110668.md) `CVE-2026-110668` · CVE record: cemtan sar2html · CVSS 6.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Other injection, SQL injection - [CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages](https://agentprime.io/advisories/CVE-2026-102471.md) `CVE-2026-102471` · CVE record: Eclipse Foundation Eclipse Vert.x · CVSS 6.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Other injection - [cpp-httplib open_stream serializes CRLF in request target into HTTP request line](https://agentprime.io/advisories/CVE-2026-103930.md) `CVE-2026-103930` · CVE record: yhirose cpp-httplib · CVSS 3.7 Low · Not analysed yet · Published 14 Oct 2026 · Tags: Other injection - [Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is used](https://agentprime.io/advisories/CVE-2026-102037.md) `CVE-2026-102037` · CVE record: Juniper Networks Junos OS · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Other injection - [Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution](https://agentprime.io/advisories/CVE-2026-93635.md) `CVE-2026-93635` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Other injection - [MOVEit Transfer LDAP injection in certificate-based authentication](https://agentprime.io/advisories/CVE-2026-89071.md) `CVE-2026-89071` · CVE record: Progress MOVEit Transfer · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Other injection - [Responsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email](https://agentprime.io/advisories/CVE-2026-97315.md) `CVE-2026-97315` · CVE record: Unknown Responsive Blocks · CVSS 5.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Other injection - [Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)](https://agentprime.io/advisories/CVE-2026-110084.md) `CVE-2026-110084` · CVE record: Adobe Adobe Experience Manager 6.5 · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection - [Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth](https://agentprime.io/advisories/CVE-2026-110256.md) `CVE-2026-110256` · CVE record: Finsys dockhand · CVSS 6.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection - [Azure Storage Library Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-88094.md) `CVE-2026-88094` · CVE record: Microsoft azure-storage-blob-batch and 1 more · CVSS 8.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection - [SourceCodester Online Reviewer System index.php prepare sql injection](https://agentprime.io/advisories/CVE-2026-109620.md) `CVE-2026-109620` · CVE record: SourceCodester Online Reviewer System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Exam System Login Endpoint loginExe.php sql injection](https://agentprime.io/advisories/CVE-2026-109607.md) `CVE-2026-109607` · CVE record: SourceCodester Online Exam System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection - [BUG-000171040 Portal for ArcGIS has a security vulnerability](https://agentprime.io/advisories/CVE-2026-10759.md) `CVE-2026-10759` · CVE record: Esri Portal for ArcGIS · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection - [SourceCodester Art Gallery Management System Account Creation admin_class.php save_user sql injection](https://agentprime.io/advisories/CVE-2026-109606.md) `CVE-2026-109606` · CVE record: SourceCodester Art Gallery Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection - [Plane: ORM Field Injection via Unvalidated \`order_by\` Parameter (Including Unauthenticated Path)](https://agentprime.io/advisories/CVE-2026-102988.md) `CVE-2026-102988` · CVE record: makeplane plane · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection - [girishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injection](https://agentprime.io/advisories/CVE-2026-109523.md) `CVE-2026-109523` · CVE record: girishsaraf Online-Appointment-Booking-System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection - [girishsaraf Online-Appointment-Booking-System Admin CRUD Endpoint deleteclinic.php sql injection](https://agentprime.io/advisories/CVE-2026-109522.md) `CVE-2026-109522` · CVE record: girishsaraf Online-Appointment-Booking-System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection - [girishsaraf Online-Appointment-Booking-System changebookingstatus.php sql injection](https://agentprime.io/advisories/CVE-2026-109521.md) `CVE-2026-109521` · CVE record: girishsaraf Online-Appointment-Booking-System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection - [Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members](https://agentprime.io/advisories/CVE-2026-109961.md) `CVE-2026-109961` · CVE record: froxlor froxlor · CVSS 8.4 High · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection - [HBAI-Ltd Toonflow-app Open Folder Endpoint openFolder.ts child_process.exec command injection](https://agentprime.io/advisories/CVE-2026-109409.md) `CVE-2026-109409` · CVE record: HBAI-Ltd Toonflow-app · CVSS 4.8 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, Command injection - [AdithyaYelloju Restaurant-Management-System Password Reset forgot3.php sql injection](https://agentprime.io/advisories/CVE-2026-109115.md) `CVE-2026-109115` · CVE record: AdithyaYelloju Restaurant-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection - [itsmeravitejak Online-Examination-System Registration Form database.php addNewUser sql injection](https://agentprime.io/advisories/CVE-2026-108970.md) `CVE-2026-108970` · CVE record: itsmeravitejak Online-Examination-System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Performance Indicator System sales_history.php sql injection](https://agentprime.io/advisories/CVE-2026-108968.md) `CVE-2026-108968` · CVE record: SourceCodester Performance Indicator System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Performance Indicator System edit_credit.php sql injection](https://agentprime.io/advisories/CVE-2026-108967.md) `CVE-2026-108967` · CVE record: SourceCodester Performance Indicator System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Performance Indicator System product.php sql injection](https://agentprime.io/advisories/CVE-2026-108966.md) `CVE-2026-108966` · CVE record: SourceCodester Performance Indicator System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Performance Indicator System edit_quantity.php sql injection](https://agentprime.io/advisories/CVE-2026-108965.md) `CVE-2026-108965` · CVE record: SourceCodester Performance Indicator System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .