# Other injection.

LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [SourceCodester Performance Indicator System addproduct.php sql injection](https://agentprime.io/advisories/CVE-2026-108964.md)
  `CVE-2026-108964` · CVE record: SourceCodester Performance Indicator System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection
- [storyicon comfyui_segment_anything GroundingDINO Model Loading slconfig.py SLConfig.\_file2dict code injection](https://agentprime.io/advisories/CVE-2026-108962.md)
  `CVE-2026-108962` · CVE record: storyicon comfyui_segment_anything · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, Code injection
- [PaddlePaddle PaddleX Preprocessor processors.py NormalizeImage.\_\_init\_\_ code injection](https://agentprime.io/advisories/CVE-2026-108961.md)
  `CVE-2026-108961` · CVE record: PaddlePaddle PaddleX · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, Code injection
- [itsourcecode Online Cake Ordering System addtransacdetail.php sql injection](https://agentprime.io/advisories/CVE-2026-108959.md)
  `CVE-2026-108959` · CVE record: itsourcecode Online Cake Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection
- [Log injection in fail2ban](https://agentprime.io/advisories/CVE-2026-109786.md)
  `CVE-2026-109786` · CVE record: fail2ban fail2ban · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection
- [TinyLLaVA TinyLLaVA_Factory TinyLlavaConfig configuration_tinyllava.py \_load_text_config code injection](https://agentprime.io/advisories/CVE-2026-108957.md)
  `CVE-2026-108957` · CVE record: TinyLLaVA TinyLLaVA_Factory · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, Code injection
- [code-projects Online Reviewer System User Update btn_functions.php sql injection](https://agentprime.io/advisories/CVE-2026-108956.md)
  `CVE-2026-108956` · CVE record: code-projects Online Reviewer System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection
- [iMoonLab yolov13 AutoBackend Model Loading autobackend.py eval code injection](https://agentprime.io/advisories/CVE-2026-108945.md)
  `CVE-2026-108945` · CVE record: iMoonLab yolov13 · CVSS 4.8 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, Code injection
- [repository RAE Config-Driven Model Instantiation model_utils.py get_obj_from_str code injection](https://agentprime.io/advisories/CVE-2026-108944.md)
  `CVE-2026-108944` · CVE record: repository RAE · CVSS 2.4 Low · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, Code injection
- [ModelTC LightX2V Tokenizer cosmos3_runner.py AutoTokenizer.from_pretrained code injection](https://agentprime.io/advisories/CVE-2026-108943.md)
  `CVE-2026-108943` · CVE record: ModelTC LightX2V · CVSS 4.8 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, Code injection
- [Linketic CityGaussian Sidecar Parsing common.py parse_cfg_args code injection](https://agentprime.io/advisories/CVE-2026-108941.md)
  `CVE-2026-108941` · CVE record: Linketic CityGaussian · CVSS 2.4 Low · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, Code injection
- [Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters](https://agentprime.io/advisories/CVE-2025-71431.md)
  `CVE-2025-71431` · CVE record: frappe frappe · CVSS 6.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection
- [Netcore NR268 DDNS DDNSset.cgi execvp argument injection](https://agentprime.io/advisories/CVE-2026-108929.md)
  `CVE-2026-108929` · CVE record: Netcore NR268 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, Command injection
- [itsourcecode Online Admission System sum.php sql injection](https://agentprime.io/advisories/CVE-2026-108928.md)
  `CVE-2026-108928` · CVE record: itsourcecode Online Admission System · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [itsourcecode Baptism Information Management System pbaptism.php sql injection](https://agentprime.io/advisories/CVE-2026-108927.md)
  `CVE-2026-108927` · CVE record: itsourcecode Baptism Information Management System · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [itsourcecode Baptism Information Management System ebaptism.php sql injection](https://agentprime.io/advisories/CVE-2026-108926.md)
  `CVE-2026-108926` · CVE record: itsourcecode Baptism Information Management System · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [Edimax BR-6208AC formWlanMP command injection](https://agentprime.io/advisories/CVE-2026-108918.md)
  `CVE-2026-108918` · CVE record: Edimax BR-6208AC · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, Command injection
- [Edimax BR-6208AC formAutoFWupgrade command injection](https://agentprime.io/advisories/CVE-2026-108917.md)
  `CVE-2026-108917` · CVE record: Edimax BR-6208AC · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, Command injection
- [Edimax BR-6208AC formAccept command injection](https://agentprime.io/advisories/CVE-2026-108916.md)
  `CVE-2026-108916` · CVE record: Edimax BR-6208AC · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, Command injection
- [HTTP response splitting in Progress MarkLogic Server Query Console](https://agentprime.io/advisories/CVE-2026-85976.md)
  `CVE-2026-85976` · CVE record: Progress Software Corporation MarkLogic Server · CVSS 5.4 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection
- [LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header](https://agentprime.io/advisories/CVE-2026-109357.md)
  `CVE-2026-109357` · CVE record: librenms librenms · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection
- [ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via MVG Decoder](https://agentprime.io/advisories/CVE-2026-109275.md)
  `CVE-2026-109275` · CVE record: ImageMagick ImageMagick · CVSS 6.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection
- [Exponent CMS XML-RPC xmlrpc.php userLogin sql injection](https://agentprime.io/advisories/CVE-2026-108900.md)
  `CVE-2026-108900` · CVE record: Exponent CMS · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports](https://agentprime.io/advisories/CVE-2026-109396.md)
  `CVE-2026-109396` · CVE record: Thelia Thelia · CVSS 2.3 Low · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection
- [Zen Cart Module Configuration modules.php sql injection](https://agentprime.io/advisories/CVE-2026-108829.md)
  `CVE-2026-108829` · CVE record: Zen Cart · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [Zen Cart Admin Panel configuration.php eval sql injection](https://agentprime.io/advisories/CVE-2026-108828.md)
  `CVE-2026-108828` · CVE record: Zen Cart · CVSS 2.1 Low · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [Zen Cart Administrative Module Management general.php zen_call_function code injection](https://agentprime.io/advisories/CVE-2026-108827.md)
  `CVE-2026-108827` · CVE record: Zen Cart · CVSS 2.1 Low · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, Code injection
- [Zen Cart PayPal IPN paypaldp.php zen_db_perform sql injection](https://agentprime.io/advisories/CVE-2026-108826.md)
  `CVE-2026-108826` · CVE record: Zen Cart · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [DataEase Utils.java Utils.buildCalcField sql injection](https://agentprime.io/advisories/CVE-2026-108824.md)
  `CVE-2026-108824` · CVE record: DataEase · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [Tencent WeKnora SQL Validator inject.go validateSubquery sql injection](https://agentprime.io/advisories/CVE-2026-108821.md)
  `CVE-2026-108821` · CVE record: Tencent WeKnora · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [agno-agi agno PythonTools python.py run_python_code code injection](https://agentprime.io/advisories/CVE-2026-108816.md)
  `CVE-2026-108816` · CVE record: agno-agi agno · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, Code injection
- [SEMCMS SEMCMS_Banner.php sql injection](https://agentprime.io/advisories/CVE-2026-108814.md)
  `CVE-2026-108814` · CVE record: SEMCMS · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [SEMCMS SEMCMS_Download.php sql injection](https://agentprime.io/advisories/CVE-2026-108813.md)
  `CVE-2026-108813` · CVE record: SEMCMS · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [Insufficient Neutralization of Formula Elements in CSV Exports](https://agentprime.io/advisories/CVE-2026-93581.md)
  `CVE-2026-93581` · CVE record: OTRS GmbH (former OTRS AG) OTRS and 1 more · CVSS 6.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection
- [krupalshah EmployeeRecruitmentSystem Registration adminregister.php mysql_query sql injection](https://agentprime.io/advisories/CVE-2026-108807.md)
  `CVE-2026-108807` · CVE record: krupalshah EmployeeRecruitmentSystem · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [krupalshah EmployeeRecruitmentSystem Forgot Password authprocessing.php mysql_query sql injection](https://agentprime.io/advisories/CVE-2026-108806.md)
  `CVE-2026-108806` · CVE record: krupalshah EmployeeRecruitmentSystem · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [krupalshah EmployeeRecruitmentSystem Login loginprocessing.php mysql_query sql injection](https://agentprime.io/advisories/CVE-2026-108805.md)
  `CVE-2026-108805` · CVE record: krupalshah EmployeeRecruitmentSystem · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [jackq XCMS Password Recovery Mail Endpoint PublicController.class.php sendFindPwdMail sql injection](https://agentprime.io/advisories/CVE-2026-108799.md)
  `CVE-2026-108799` · CVE record: jackq XCMS · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection](https://agentprime.io/advisories/CVE-2026-108794.md)
  `CVE-2026-108794` · CVE record: ZKTeco BioTime · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [erzhongxmu JEEWMS Autocomplete CommonServiceImpl.java CommonServiceImpl.getAutoList sql injection](https://agentprime.io/advisories/CVE-2026-108782.md)
  `CVE-2026-108782` · CVE record: erzhongxmu JEEWMS · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [erzhongxmu JEEWMS PDA WmToMoveGoodsController.java WmToMoveGoodsController.list sql injection](https://agentprime.io/advisories/CVE-2026-108781.md)
  `CVE-2026-108781` · CVE record: erzhongxmu JEEWMS · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [erzhongxmu JEEWMS WmSttInGoodsController.java WmSttInGoodsController.list sql injection](https://agentprime.io/advisories/CVE-2026-108779.md)
  `CVE-2026-108779` · CVE record: erzhongxmu JEEWMS · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [erzhongxmu JEEWMS Inbound Quality Check Pda WmInQmIController.java WmInQmIController.list sql injection](https://agentprime.io/advisories/CVE-2026-108778.md)
  `CVE-2026-108778` · CVE record: erzhongxmu JEEWMS · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Other injection, SQL injection
- [erzhongxmu JEEWMS WvGiController.java WvGiController.list sql injection](https://agentprime.io/advisories/CVE-2026-108777.md)
  `CVE-2026-108777` · CVE record: erzhongxmu JEEWMS · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Other injection, SQL injection
- [erzhongxmu JEEWMS Search Endpoint WvNoticeController.java WvNoticeController.list sql injection](https://agentprime.io/advisories/CVE-2026-108775.md)
  `CVE-2026-108775` · CVE record: erzhongxmu JEEWMS · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Other injection, SQL injection
- [erzhongxmu JEEWMS MdBinController.java getbinallagv sql injection](https://agentprime.io/advisories/CVE-2026-108774.md)
  `CVE-2026-108774` · CVE record: erzhongxmu JEEWMS · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Other injection, SQL injection
- [erzhongxmu JEEWMS WmOmNoticeHController.java docheck sql injection](https://agentprime.io/advisories/CVE-2026-108773.md)
  `CVE-2026-108773` · CVE record: erzhongxmu JEEWMS · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Other injection, SQL injection
- [erzhongxmu Jeewms Autocomplete Data JeecgFormDemoController.java getTreeData sql injection](https://agentprime.io/advisories/CVE-2026-108684.md)
  `CVE-2026-108684` · CVE record: erzhongxmu Jeewms · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Other injection, SQL injection
- [Xinhu Rainrock RockOA Openkqj Action openkqjAction.php returnchuli sql injection](https://agentprime.io/advisories/CVE-2026-108571.md)
  `CVE-2026-108571` · CVE record: Xinhu Rainrock RockOA · CVSS 6.9 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Other injection, SQL injection
- [Furion .NET Framework StringRenderExtensions.cs String.Replace sql injection](https://agentprime.io/advisories/CVE-2026-108569.md)
  `CVE-2026-108569` · CVE record: Furion .NET Framework · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Other injection, SQL injection
- [highwarden Super Store Finder index.php sql injection](https://agentprime.io/advisories/CVE-2026-108541.md)
  `CVE-2026-108541` · CVE record: highwarden Super Store Finder · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Other injection, SQL injection
- [OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export](https://agentprime.io/advisories/CVE-2026-108579.md)
  `CVE-2026-108579` · CVE record: Openpanel-dev openpanel · CVSS 2.3 Low · Not analysed yet · Published 10 Oct 2026 · Tags: Other injection
- [Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'](https://agentprime.io/advisories/CVE-2026-102291.md)
  `CVE-2026-102291` · CVE record: themeum Kirki – Freeform Page Builder, Website Builder & Customizer · CVSS 5.4 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Other injection
- [Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection](https://agentprime.io/advisories/CVE-2026-84220.md)
  `CVE-2026-84220` · CVE record: Unknown Kirki · CVSS 4.8 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Other injection
- [LangChain: MongoDBChatMessageHistory query injection can allow cross-session access](https://agentprime.io/advisories/GHSA-m6rx-h84q-8r95.md)
  `GHSA-m6rx-h84q-8r95`, `CVE-2026-106119` · npm `@langchain/mongodb`: affected `<1.3.1`, fixed in `1.3.1` · CVSS 6.0 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Other injection
- [PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL](https://agentprime.io/advisories/GHSA-wf65-4jjx-q444.md)
  `GHSA-wf65-4jjx-q444`, `CVE-2026-60090`, `PYSEC-2026-4260` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: SQL injection, Other injection
- [CRLF injection in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87661.md)
  `CVE-2026-87661` · CVE record: Brocade Fabric OS · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Other injection
- [CRLF injection in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87678.md)
  `CVE-2026-87678` · CVE record: Brocade Fabric OS · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Other injection
- [Log Injection through the REST API in Splunk App for Splunk O11y Cloud](https://agentprime.io/advisories/CVE-2026-76267.md)
  `CVE-2026-76267` · CVE record: Splunk Splunk Enterprise · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Other injection
- [Ghost: Password Hash Ordering Disclosure in Ghost Admin API](https://agentprime.io/advisories/GHSA-53vv-xm9f-mm82.md)
  `GHSA-53vv-xm9f-mm82`, `BIT-ghost-2026-104415`, `BIT-ghost-2026-105652`, `CVE-2026-104415`, `CVE-2026-105652` · npm `ghost`: affected `>=0.7.2, <6.64.0`, fixed in `6.64.0` · CVSS 2.3 Low · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure, Other injection

Newest: <https://agentprime.io/advisories/tag/injection.md>
Older: <https://agentprime.io/advisories/tag/injection.md?cursor=WyIyMDI2LTEwLTA3VDIwOjI3OjIyLjAwMDAwMFoiLCJHSFNBLTUzdnYteG05Zi1tbTgyIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=injection&cursor=WyIyMDI2LTEwLTEzVDA0OjAwOjE2LjM0NTAwMFoiLCJDVkUtMjAyNi0xMDg5NjUiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/injection/?cursor=WyIyMDI2LTEwLTEzVDA0OjAwOjE2LjM0NTAwMFoiLCJDVkUtMjAyNi0xMDg5NjUiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.