Advisories · Weakness
Other injection.
LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.9 Medium
code-projects Simple Laundry System Parameter delmemberinfo.php sql injection
- code-projects Simple Laundry System
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Simple Laundry System Parameter searchguest.php sql injection
- code-projects Simple Laundry System
- Other injection
- SQL injection
- CVSS 5.3 Medium
AutohomeCorp frostmourne Alarm Preview previewData httpTest sql injection
- AutohomeCorp frostmourne
- Other injection
- SQL injection
- CVSS 6.9 Medium
provectus kafka-ui Endpoint testexecutions validateAccess code injection
- provectus kafka-ui
- Other injection
- Code injection
- CVSS 5.3 Medium
Campcodes Complete POS Management and Inventory System Environment Variable SettingsController.php injection
- Campcodes Complete POS Management and Inventory System
- Other injection
- CWE-707
- CVSS 5.3 Medium
PHPGurukul Online Shopping Portal Project Parameter payment-method.php sql injection
- PHPGurukul Online Shopping Portal Project
- Other injection
- SQL injection
- CVSS 5.3 Medium
PHPGurukul PHPGurukul Online Shopping Portal Project Parameter pending-orders.php sql injection
- PHPGurukul Online Shopping Portal Project
- Other injection
- SQL injection
- CVSS 5.3 Medium
badlogic pi-mono loader.ts discoverAndLoadExtensions code injection
- badlogic pi-mono
- Other injection
- Code injection
- CVSS 6.9 Medium
code-projects Concert Ticket Reservation System Parameter login.php sql injection
- code-projects Concert Ticket Reservation System
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Concert Ticket Reservation System Parameter process_search.php sql injection
- code-projects Concert Ticket Reservation System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Online Cellphone System Parameter available.php sql injection
- itsourcecode Online Cellphone System
- Other injection
- SQL injection
- CVSS 5.3 Medium
PHPGurukul Online Shopping Portal Project Parameter sub-category.php sql injection
- PHPGurukul Online Shopping Portal Project
- Other injection
- SQL injection
- CVSS 6.9 Medium
itsourcecode Free Hotel Reservation System Parameter login.php sql injection
- itsourcecode Free Hotel Reservation System
- Other injection
- SQL injection
- CVSS 5.3 Medium
PHPGurukul User Registration & Login and User Management System yesterday-reg-users.php sql injection
- PHPGurukul User Registration & Login and User Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Simple Laundry System Parameter modifymember.php sql injection
- code-projects Simple Laundry System
- Other injection
- SQL injection
- CVSS 5.3 Medium
halex CourseSEL HTTP GET Parameter IndexController.class.php check_sel sql injection
- halex CourseSEL
- Other injection
- SQL injection
- CVSS 6.9 Medium
itsourcecode Online Enrollment System Parameter index.php sql injection
- itsourcecode Online Enrollment System
- Other injection
- SQL injection
- CVSS 4.7 Medium
Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows
- Other injection
- CWE-20
<38.8.6 || >=39.0.0-alpha.1, <39.8.1 || >=40.0.0-alpha.1, <40.8.1 || >=41.0.0-alpha.1, <41.0.0 · fixed in 38.8.6, 39.8.1, 40.8.1, 41.0.0
GHSA-mwmh-mq4g-g6gr · CVE-2026-34773 - CVSS 5.9 Medium
Electron: HTTP Response Header Injection in custom protocol handlers and webRequest
- Other injection
<38.8.6 || >=39.0.0-alpha.1, <39.8.3 || >=40.0.0-alpha.1, <40.8.3 || >=41.0.0-alpha.1, <41.0.3 · fixed in 38.8.6, 39.8.3, 40.8.3, 41.0.3
GHSA-4p4r-m79c-wq3v · CVE-2026-34767 - CVSS 4.8 Medium
Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values
- Other injection
>=3.2.0, <3.2.6 · fixed in 3.2.6
GHSA-rx22-g9mx-qrhv · CVE-2026-26962 - CVSS 6.9 Medium
projectworlds Car Rental Project Parameter login.php sql injection
- projectworlds Car Rental Project
- Other injection
- SQL injection
- CVSS 5.1 Medium
Tenda G103 Setting gpon.lua action_set_net_settings command injection
- Tenda G103
- Other injection
- Command injection
- CVSS 5.1 Medium
Tenda G103 Setting system.lua action_set_system_settings command injection
- Tenda G103
- Other injection
- Command injection
- CVSS 6.9 Medium
itsourcecode Online Enrollment System Parameter index.php sql injection
- itsourcecode Online Enrollment System
- Other injection
- SQL injection
- CVSS 6.9 Medium
DefaultFuction Content-Management-System tools.php command injection
- DefaultFuction Content-Management-System
- Other injection
- Command injection
- CVSS 5.3 Medium
fast-filesystem-mcp is vulnerable to command injection through handleGetDiskUsage function
- Other injection
- Command injection
<=3.5.0 · no fixed version yet
GHSA-5226-3rvg-hp4x · CVE-2026-5327 - CVSS 5.3 Medium
shsuishang modulithshop ProductItemDao ProductIndexServiceImpl.java listItem sql injection
- shsuishang modulithshop
- Other injection
- SQL injection
- CVSS 6.3 Medium
PGP Decryption Sender LDAP Injection
- SEPPmail Secure Email Gateway
- Other injection
- CVSS 4.9 Medium
PGP Decryption Recipient LDAP Injection
- SEPPmail Secure Email Gateway
- Other injection
- CVSS 6.9 Medium
AlejandroArciniegas mcp-data-vis MCP server.js request sql injection
- AlejandroArciniegas mcp-data-vis
- Other injection
- SQL injection
- CVSS 6.9 Medium
phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure
- Other injection
<4.1.1 · fixed in 4.1.1
GHSA-gcp9-5jc8-976x · CVE-2026-34973 - CVSS 5.3 Medium
ewe Has Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response Splitting)
- Other injection
<3.0.6 · fixed in 3.0.6
GHSA-x2w3-23jr-hrpf · CVE-2026-34715 - CVSS 2.7 Low
AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass
- Other injection
<3.13.4 · fixed in 3.13.4
GHSA-63hf-3vf5-4wqf · CVE-2026-34520 - CVSS 2.7 Low
AIOHTTP has HTTP response splitting via \r in reason phrase
- Other injection
<3.13.4 · fixed in 3.13.4
GHSA-mwh4-6h8g-pg8w · CVE-2026-34519 - CVSS 2.7 Low
AIOHTTP has CRLF injection through multipart part content type header construction
- Other injection
<3.13.4 · fixed in 3.13.4
GHSA-2vrm-gr82-f7m5 · CVE-2026-34514 - CVSS 6.9 Medium
code-projects Simple Laundry System Parameter delstaffinfo.php sql injection
- code-projects Simple Laundry System
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Simple Laundry System Parameter modify.php sql injection
- code-projects Simple Laundry System
- Other injection
- SQL injection
- CVSS 7.5 High
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
- Other injection
<=0.6.0 · no fixed version yet
GHSA-wh4c-j3r5-mjhp · CVE-2026-34601 - CVSS 6.9 Medium
itsourcecode Payroll Management System Parameter view_employee.php sql injection
- itsourcecode Payroll Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
itsourcecode Payroll Management System Parameter manage_user.php sql injection
- itsourcecode Payroll Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
code-projects Simple Gym Management System Payment sql injection
- code-projects Simple Gym Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Student Membership System Admin Login index.php sql injection
- code-projects Student Membership System
- Other injection
- SQL injection
- CVSS 5.3 Medium
code-projects Student Membership System delete_user.php sql injection
- code-projects Student Membership System
- Other injection
- SQL injection
- CVSS 5.3 Medium
code-projects Student Membership System delete_member.php sql injection
- code-projects Student Membership System
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Student Membership System User Registration sql injection
- code-projects Student Membership System
- Other injection
- SQL injection
- CVSS 5.3 Medium
TRENDnet TEW-713RE setSysAdm command injection
- TRENDnet TEW-713RE
- Other injection
- Command injection
- CVSS 5.3 Medium
TRENDnet TEW-713RE addRouting sub_421494 command injection
- TRENDnet TEW-713RE
- Other injection
- Command injection
- CVSS 6.9 Medium
SourceCodester Teacher Record System Parameter sql injection
- SourceCodester Teacher Record System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Simple Doctors Appointment System ajax.php sql injection
- SourceCodester Simple Doctors Appointment System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Simple Doctors Appointment System login.php sql injection
- SourceCodester Simple Doctors Appointment System
- Other injection
- SQL injection
- CVSS 5.3 Medium
Totolink A3300R cstecgi.cgi setIptvCfg command injection
- Totolink A3300R
- Other injection
- Command injection
- CVSS 5.3 Medium
Totolink A3300R cstecgi.cgi setWiFiBasicCfg command injection
- Totolink A3300R
- Other injection
- Command injection
- CVSS 6.9 Medium
Totolink A3300R cstecgi.cgi setSyslogCfg command injection
- Totolink A3300R
- Other injection
- Command injection
- CVSS 5.3 Medium
Tenda CH22 WriteFacMac FormWriteFacMac command injection
- Tenda CH22
- Other injection
- Command injection
- CVSS 6.9 Medium
code-projects Accounting System Parameter viewin_costumer.php sql injection
- code-projects Accounting System
- Other injection
- SQL injection
- CVSS 5.1 Medium
YunaiV yudao-cloud page sql injection
- YunaiV yudao-cloud
- Other injection
- SQL injection
- CVSS 6.9 Medium
YunaiV yudao-cloud get-by-website sql injection
- YunaiV yudao-cloud
- Other injection
- SQL injection
- CVSS 5.3 Medium
Totolink A3300R Parameter cstecgi.cgi setVpnPassCfg command injection
- Totolink A3300R
- Other injection
- Command injection
- CVSS 5.3 Medium
Totolink A3300R cstecgi.cgi setStaticRoute command injection
- Totolink A3300R
- Other injection
- Command injection
- CVSS 5.3 Medium
Totolink A3300R cstecgi.cgi setUPnPCfg command injection
- Totolink A3300R
- Other injection
- Command injection