# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting](https://agentprime.io/advisories/CVE-2026-103405.md) `CVE-2026-103405` · CVE record: Juniper Networks Session Smart Router and 1 more · CVSS 5.8 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Other injection - [Session Smart Router and Session Smart Conductor: Crafted directory names cause arbitrary filesystem unmounting during service cleanup](https://agentprime.io/advisories/CVE-2026-103400.md) `CVE-2026-103400` · CVE record: Juniper Networks Session Smart Router and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Other injection - [Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields](https://agentprime.io/advisories/CVE-2026-67187.md) `CVE-2026-67187` · CVE record: Saturday Drive Ninja Forms · CVSS 5.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Other injection - [Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16](https://agentprime.io/advisories/CVE-2026-102799.md) `CVE-2026-102799` · CVE record: icagenda.com iCagenda extension for Joomla · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Other injection - [Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes](https://agentprime.io/advisories/CVE-2026-106648.md) `CVE-2026-106648` · CVE record: Unknown Royal Elementor Addons · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Other injection - [LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path](https://agentprime.io/advisories/CVE-2026-118372.md) `CVE-2026-118372` · CVE record: OpenBSD LibreSSL · CVSS 6.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Other injection - [LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line](https://agentprime.io/advisories/CVE-2026-118371.md) `CVE-2026-118371` · CVE record: OpenBSD LibreSSL · CVSS 6.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Other injection - [reduxjs redux-devtools Remotedev Server evalAction code injection](https://agentprime.io/advisories/CVE-2026-117526.md) `CVE-2026-117526` · CVE record: reduxjs redux-devtools · CVSS 4.8 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Other injection, Code injection - [Tanium addressed an improper output sanitization vulnerability in Enforce.](https://agentprime.io/advisories/CVE-2026-116649.md) `CVE-2026-116649` · CVE record: Tanium Enforce · CVSS 7.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Other injection - [Tanium addressed an improper output sanitization vulnerability in Comply.](https://agentprime.io/advisories/CVE-2026-116647.md) `CVE-2026-116647` · CVE record: Tanium Comply · CVSS 7.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Other injection - [oretnom23 php-travel-agency-system Contact Form contact_insert.php sql injection](https://agentprime.io/advisories/CVE-2026-117516.md) `CVE-2026-117516` · CVE record: oretnom23 php-travel-agency-system · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Other injection, SQL injection - [oretnom23 php-travel-agency-system traceapplication.php sql injection](https://agentprime.io/advisories/CVE-2026-117515.md) `CVE-2026-117515` · CVE record: oretnom23 php-travel-agency-system · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Other injection, SQL injection - [oretnom23 php-travel-agency-system Admin Record Pages customer_detail.php sql injection](https://agentprime.io/advisories/CVE-2026-117514.md) `CVE-2026-117514` · CVE record: oretnom23 php-travel-agency-system · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Other injection, SQL injection - [oretnom23 php-travel-agency-system Admin Search Pages customer_search.php sql injection](https://agentprime.io/advisories/CVE-2026-117513.md) `CVE-2026-117513` · CVE record: oretnom23 php-travel-agency-system · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Other injection, SQL injection - [Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets](https://agentprime.io/advisories/CVE-2026-93434.md) `CVE-2026-93434` · CVE record: WatchGuard Fireware OS · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Other injection, CWE-20, CWE-208 - [Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (\_escape()) - full graph wipe from ingested-document content](https://agentprime.io/advisories/GHSA-vqrg-773h-4wxc.md) `GHSA-vqrg-773h-4wxc`, `CVE-2026-114510` · PyPI `flexible-graphrag`: affected `>=0.6.0, <0.8.2`, fixed in `0.8.2` · CVSS 7.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Other injection, CWE-116 - [Ghost: Authorization Bypass in Comment Like Feature](https://agentprime.io/advisories/GHSA-qrh6-cwg3-343x.md) `GHSA-qrh6-cwg3-343x`, `BIT-ghost-2026-103288`, `CVE-2026-103288` · npm `ghost`: affected `>=5.9.0, <6.44.1`, fixed in `6.44.1` · CVSS 7.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control, Other injection - [Other issue in the Console component](https://agentprime.io/advisories/CVE-2026-117977.md) `CVE-2026-117977` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Other injection - [Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query](https://agentprime.io/advisories/CVE-2026-116801.md) `CVE-2026-116801` · CVE record: parse-community parse-server · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection - [itsourcecode Online Book Store book.php sql injection](https://agentprime.io/advisories/CVE-2026-116515.md) `CVE-2026-116515` · CVE record: itsourcecode Online Book Store · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection, SQL injection - [TOTOLINK A950RG firewall.so apmib_set command injection](https://agentprime.io/advisories/CVE-2026-116506.md) `CVE-2026-116506` · CVE record: TOTOLINK A950RG · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection, Command injection - [TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection](https://agentprime.io/advisories/CVE-2026-116505.md) `CVE-2026-116505` · CVE record: TOTOLINK A950RG · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection, Command injection - [TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection](https://agentprime.io/advisories/CVE-2026-116504.md) `CVE-2026-116504` · CVE record: TOTOLINK A950RG · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection, Command injection - [Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)](https://agentprime.io/advisories/CVE-2026-57193.md) `CVE-2026-57193` · CVE record: asterisk asterisk and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection - [CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney](https://agentprime.io/advisories/EEF-CVE-2026-112880.md) `EEF-CVE-2026-112880`, `CVE-2026-112880` · Hex `hackney`: affected `>=2.0.0, <4.9.0`, fixed in `4.9.0` · CVSS 2.1 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection - [AllenAI AllenNLP Registrable Configuration Machinery registrable.py Registrable.resolve_class_name code injection](https://agentprime.io/advisories/CVE-2026-116275.md) `CVE-2026-116275` · CVE record: AllenAI AllenNLP · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection, Code injection - [DedeCMS Advertisement Rendering ad_js.php \_RunMagicQuotes code injection](https://agentprime.io/advisories/CVE-2026-116253.md) `CVE-2026-116253` · CVE record: DedeCMS · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection, Code injection - [Oray Pugongying X5 Pro Dnsmasq crlf injection](https://agentprime.io/advisories/CVE-2026-116237.md) `CVE-2026-116237` · CVE record: Oray Pugongying X5 Pro · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection - [Oray Pugongying X5 Pro L2TP Authentication crlf injection](https://agentprime.io/advisories/CVE-2026-116235.md) `CVE-2026-116235` · CVE record: Oray Pugongying X5 Pro · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection - [Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection](https://agentprime.io/advisories/CVE-2026-116234.md) `CVE-2026-116234` · CVE record: Oray Pugongying X5 Pro · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection - [Oray Pugongying X5 Pro Dnsmasq crlf injection](https://agentprime.io/advisories/CVE-2026-116233.md) `CVE-2026-116233` · CVE record: Oray Pugongying X5 Pro · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection - [Oray Pugongying X5 Pro SNMP snmp_set crlf injection](https://agentprime.io/advisories/CVE-2026-116232.md) `CVE-2026-116232` · CVE record: Oray Pugongying X5 Pro · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection - [Oray Pugongying X5 Pro Ser2net crlf injection](https://agentprime.io/advisories/CVE-2026-116231.md) `CVE-2026-116231` · CVE record: Oray Pugongying X5 Pro · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection - [HashenUdara edoc-doctor-appointment-system add-new.php sql injection](https://agentprime.io/advisories/CVE-2026-116112.md) `CVE-2026-116112` · CVE record: HashenUdara edoc-doctor-appointment-system · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection, SQL injection - [Sony Neural Network Libraries NNP Converter utils.py func_set_nnabla_version_decorate code injection](https://agentprime.io/advisories/CVE-2026-116104.md) `CVE-2026-116104` · CVE record: Sony Neural Network Libraries · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection, Code injection - [Sony Neural Network Libraries Encode Param encode_decode_param.py load_param_in_txt code injection](https://agentprime.io/advisories/CVE-2026-116103.md) `CVE-2026-116103` · CVE record: Sony Neural Network Libraries · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection, Code injection - [itsourcecode Online Cake Ordering System deletetransac.php sql injection](https://agentprime.io/advisories/CVE-2026-116101.md) `CVE-2026-116101` · CVE record: itsourcecode Online Cake Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection, SQL injection - [DedeCMS update_guide.php require_once code injection](https://agentprime.io/advisories/CVE-2026-116063.md) `CVE-2026-116063` · CVE record: DedeCMS · CVSS 5.1 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Other injection, Code injection - [SourceCodester Performance Indicator System save_profile.php sql injection](https://agentprime.io/advisories/CVE-2026-116062.md) `CVE-2026-116062` · CVE record: SourceCodester Performance Indicator System · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Performance Indicator System edit_dealer.php sql injection](https://agentprime.io/advisories/CVE-2026-116061.md) `CVE-2026-116061` · CVE record: SourceCodester Performance Indicator System · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Performance Indicator System adddealer.php sql injection](https://agentprime.io/advisories/CVE-2026-116060.md) `CVE-2026-116060` · CVE record: SourceCodester Performance Indicator System · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Other injection, SQL injection - [Alfresco Activiti JuelScriptEngine.java JuelScriptEngine.eval code injection](https://agentprime.io/advisories/CVE-2026-116058.md) `CVE-2026-116058` · CVE record: Alfresco Activiti · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Other injection, Code injection - [SourceCodester Performance Indicator System deleteproduct.php sql injection](https://agentprime.io/advisories/CVE-2026-116055.md) `CVE-2026-116055` · CVE record: SourceCodester Performance Indicator System · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Other injection, SQL injection - [krupalshah Employee Recruitment System Registration registerform3.php sql injection](https://agentprime.io/advisories/CVE-2026-116050.md) `CVE-2026-116050` · CVE record: krupalshah Employee Recruitment System · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Other injection, SQL injection - [krupalshah EmployeeRecruitmentSystem Registration Wizard registerform2.php mysql_query sql injection](https://agentprime.io/advisories/CVE-2026-116049.md) `CVE-2026-116049` · CVE record: krupalshah EmployeeRecruitmentSystem · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Other injection, SQL injection - [krupalshah EmployeeRecruitmentSystem Registration registerform1.php mysql_query sql injection](https://agentprime.io/advisories/CVE-2026-116048.md) `CVE-2026-116048` · CVE record: krupalshah EmployeeRecruitmentSystem · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Other injection, SQL injection - [mansi-k Restaurant_IMS lsmodal.php mysqli_connect sql injection](https://agentprime.io/advisories/CVE-2026-115999.md) `CVE-2026-115999` · CVE record: mansi-k Restaurant_IMS · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Other injection, SQL injection - [pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection](https://agentprime.io/advisories/CVE-2026-115997.md) `CVE-2026-115997` · CVE record: pig-mesh pig · CVSS 5.3 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Other injection, SQL injection - [Travisun Opptrix Import Endpoint import code injection](https://agentprime.io/advisories/CVE-2026-115970.md) `CVE-2026-115970` · CVE record: Travisun Opptrix · CVSS 6.9 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Other injection, Code injection - [Travisun Opptrix Schedule API setup command injection](https://agentprime.io/advisories/CVE-2026-115969.md) `CVE-2026-115969` · CVE record: Travisun Opptrix · CVSS 6.9 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Other injection, Command injection - [Path traversal in post media lets any registered user read server files](https://agentprime.io/advisories/CVE-2026-115932.md) `CVE-2026-115932` · CVE record: GitroomHQ postiz-app · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: Path traversal, Other injection - [virtualenv: Venv configuration readback can reinterpret path boundaries](https://agentprime.io/advisories/GHSA-qmx5-4p3x-wvqf.md) `GHSA-qmx5-4p3x-wvqf`, `BIT-virtualenv-2026-113715`, `CVE-2026-113715` · PyPI `virtualenv`: affected `<21.14.9`, fixed in `21.14.9` · CVSS 2.0 Low · Not analysed yet · Published 23 Oct 2026 · Tags: Other injection - [Duplicate Advisory: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)](https://agentprime.io/advisories/GHSA-w47m-j727-m843.md) `GHSA-w47m-j727-m843` · npm `i18next-http-backend`: affected `<=4.0.2`, no fixed version yet · CVSS 3.1 Low · Withdrawn · Not analysed yet · Published 23 Oct 2026 · Tags: Other injection - [Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS](https://agentprime.io/advisories/CVE-2026-55486.md) `CVE-2026-55486` · CVE record: intranda goobi-viewer-core · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS), Other injection, Code injection - [Goobi viewer: Solr injection via unvalidated region parameter in spatial search](https://agentprime.io/advisories/CVE-2026-55465.md) `CVE-2026-55465` · CVE record: intranda goobi-viewer-core · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: SQL injection, Other injection - [Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters](https://agentprime.io/advisories/CVE-2026-55444.md) `CVE-2026-55444` · CVE record: intranda goobi-viewer-core · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: SQL injection, Other injection, CWE-20 - [Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address](https://agentprime.io/advisories/CVE-2026-115785.md) `CVE-2026-115785` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 4.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Other injection - [Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name](https://agentprime.io/advisories/CVE-2026-93636.md) `CVE-2026-93636` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 4.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Other injection - [Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message](https://agentprime.io/advisories/CVE-2026-94263.md) `CVE-2026-94263` · CVE record: Unknown Advanced Custom Fields: Extended and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Other injection - [Part-DB: Spreadsheet Formula Injection in XLSX Part Exports](https://agentprime.io/advisories/CVE-2026-86020.md) `CVE-2026-86020` · CVE record: Part-DB Part-DB-server · CVSS 4.6 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Other injection, CWE-20 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .