Advisories · Weakness
Other injection.
LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.9 Medium
SourceCodester Computer Repair Shop Management System manage_product.php sql injection
- SourceCodester Computer Repair Shop Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Real State Services Login loginuser.php sql injection
- code-projects Real State Services
- Other injection
- SQL injection
- CVSS 6.9 Medium
CodeAstro Online Job Portal application_status.php sql injection
- CodeAstro Online Job Portal
- Other injection
- SQL injection
- CVSS 6.9 Medium
CodeAstro Online Job Portal delete-jobs.php sql injection
- CodeAstro Online Job Portal
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Content Management System add_sub_topic.php sql injection
- itsourcecode Content Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Content Management System update_ss_img.php sql injection
- itsourcecode Content Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Content Management System save_comment.php sql injection
- itsourcecode Content Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
itsourcecode Online House Rental System manage_payment.php sql injection
- itsourcecode Online House Rental System
- Other injection
- SQL injection
- CVSS 6.9 Medium
itsourcecode Online House Rental System manage_tenant.php sql injection
- itsourcecode Online House Rental System
- Other injection
- SQL injection
- CVSS 6.9 Medium
itsourcecode Online House Rental System ajax.php login sql injection
- itsourcecode Online House Rental System
- Other injection
- SQL injection
- CVSS 6.9 Medium
itsourcecode Online Blood Bank Management System campsdetails.php sql injection
- itsourcecode Online Blood Bank Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
itsourcecode Online Blood Bank Management System viewrequest.php sql injection
- itsourcecode Online Blood Bank Management System
- Other injection
- SQL injection
- CVSS 5.1 Medium
SourceCodester Pharmacy Sales and Inventory System Supplier Creation export create_supplier csv injection
- SourceCodester Pharmacy Sales and Inventory System
- Other injection
- CVSS 5.3 Medium
itsourcecode Content Management System instructions.php sql injection
- itsourcecode Content Management System
- Other injection
- SQL injection
- CVSS 5.1 Medium
SourceCodester Water Billing Management System User Management manage_user sql injection
- SourceCodester Water Billing Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
CodeAstro Ingredients Stock Management System stock_manager.php sql injection
- CodeAstro Ingredients Stock Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
hermes-agent has an Injection issue
- Other injection
- CWE-707
<0.15.0 · fixed in 0.15.0
GHSA-33qv-c5qm-799v · CVE-2026-10223 - CVSS 6.9 Medium
hermes-agent has an Injection issue
- Other injection
- CWE-707
<=0.19.0 · no fixed version yet
GHSA-xq8w-9jvx-gm3v · CVE-2026-10221 - CVSS 6.3 Medium
hermes-agent has an Injection issue
- Other injection
- CWE-707
<0.18.0 · fixed in 0.18.0
GHSA-mv8x-fg99-32mf · CVE-2026-10222 - CVSS 6.9 Medium
raisulislamg4 student_management_system_by_php User Creation add_user_check.php sql injection
- raisulislamg4 student_management_system_by_php
- Other injection
- SQL injection
- CVSS 6.9 Medium
raisulislamg4 student_management_system_by_php delete.php sql injection
- raisulislamg4 student_management_system_by_php
- Other injection
- SQL injection
- CVSS 6.9 Medium
raisulislamg4 student_management_system_by_php Login login_check.php sql injection
- raisulislamg4 student_management_system_by_php
- Other injection
- SQL injection
- CVSS 6.9 Medium
NousResearch hermes-agent skills_tool.py skill_view injection
- NousResearch hermes-agent
- Other injection
- CWE-707
- CVSS 5.3 Medium
AstrBotDevs AstrBot skill_manager.py _sanitize_prompt_description injection
- AstrBot
- Other injection
- CWE-707
- CVSS 5.3 Medium
code-projects Online Hospital Management System Appointment appointmentdetail.php sql injection
- code-projects Online Hospital Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Online Hospital Management System login_1.php login_user sql injection
- code-projects Online Hospital Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
OFCMS JSON Query SysUserController.java query sql injection
- OFCMS
- Other injection
- SQL injection
- CVSS 5.3 Medium
OFCMS JSON Query SystemParamController.java query sql injection
- OFCMS
- Other injection
- SQL injection
- CVSS 5.3 Medium
OFCMS JSON Query SystemDictController.java query sql injection
- OFCMS
- Other injection
- SQL injection
- CVSS 5.3 Medium
OFCMS ComnController ComnController.java query sql injection
- OFCMS
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Online Hospital Management System patient.php sql injection
- code-projects Online Hospital Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Hospitals Patient Records Management System Users.php save sql injection
- SourceCodester Hospitals Patient Records Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Hospitals Patient Records Management System Users.php delete sql injection
- SourceCodester Hospitals Patient Records Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
TRENDnet TEW-432BRP formWlanSetup command injection
- TRENDnet TEW-432BRP
- Other injection
- Command injection
- CVSS 5.3 Medium
TRENDnet TEW-432BRP formSysCmd command injection
- TRENDnet TEW-432BRP
- Other injection
- Command injection
- CVSS 6.9 Medium
code-projects Online Music Site AdminEditAlbum.php sql injection
- code-projects Online Music Site
- Other injection
- SQL injection
- CVSS 5.3 Medium
Aider is vulnerable to Code Injection via editor_coder.run function
- Other injection
- Code injection
<=0.86.2 · no fixed version yet
GHSA-7w7m-v5vp-w699 · CVE-2026-10175 - CVSS 5.3 Medium
Aider-AI Aider Code Generation Workflow sql injection
- Aider
- Other injection
- SQL injection
- CVSS 5.1 Medium
code-projects Online Music Site AdminUpdateAlbum.php sql injection
- code-projects Online Music Site
- Other injection
- SQL injection
- CVSS 5.3 Medium
code-projects Visitor Management System phone_0.php sql injection
- code-projects Visitor Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
Edimax BR-6478AC POST Request formWlbasic command injection
- Edimax BR-6478AC
- Other injection
- Command injection
- CVSS 5.1 Medium
Bdtask Multi-Store Inventory Management System Accounts Report Accounts.php accounts_report_search sql injection
- Bdtask Multi-Store Inventory Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
Edimax BR-6478AC POST Request formStaDrvSetup command injection
- Edimax BR-6478AC
- Other injection
- Command injection
- CVSS 6.9 Medium
sambitraj STUDENT-MANAGEMENT-SYSTEM Login Page sql injection
- sambitraj STUDENT-MANAGEMENT-SYSTEM
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Student Details Management System index.php sql injection
- code-projects Student Details Management System
- Other injection
- SQL injection
- CVSS 9.9 CriticalCritical · CVSS 9+
cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection
- yhirose cpp-httplib
- Other injection
- HTTP request smuggling
- CVSS 3.7 Low
Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
- Other injection
- Prototype pollution
>=1.15.2, <1.16.0 · fixed in 1.16.0
GHSA-654m-c8p4-x5fp · CVE-2026-44489 - CVSS 8.6 High
Froxlor has an incomplete fix for CVE-2026-30932
- Other injection
<2.3.7 · fixed in 2.3.7
GHSA-j6fm-9rfm-j5hx · CVE-2026-41237 - CVSS 9.9 CriticalCritical · CVSS 9+
XPath injection in WebPros Plesk
- WebPros Plesk
- Other injection
- CVSS 5.3 Medium
TRENDnet TEW-432BRP formWPS command injection
- TRENDnet TEW-432BRP
- Other injection
- Command injection
- CVSS 5.3 Medium
TRENDnet TEW-432BRP formSetRoute command injection
- TRENDnet TEW-432BRP
- Other injection
- Command injection
- CVSS 8.1 High
LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instances
- Kovah LinkAce
- Other injection
- CVSS 6.9 Medium
Music Player Daemon < 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxx
- MusicPlayerDaemon MPD
- Other injection
- CVSS 7.3 High
Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths
- RRWO Plack::Middleware::Security::Common
- Other injection
- CWE-790
- CVSS 7.0 High
json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio
- Other injection
>=3.15.0, <5.5.11 · fixed in 5.5.11
GHSA-g27c-q7cp-mhx6 · CVE-2026-9673 - CVSS 6.3 Medium
Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names
- Other injection
<5.4.52 || >=6.0.0, <6.4.40 || >=7.0.0, <7.4.12 || >=8.0.0, <8.0.12 · fixed in 5.4.52, 6.4.40, 7.4.12, 8.0.12
GHSA-vqc8-7275-q272 · CVE-2026-45070 - CVSS 6.3 Medium
Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
- Other injection
<5.4.52 || >=6.0.0, <6.4.40 || >=7.0.0, <7.4.12 || >=8.0.0, <8.0.12 · fixed in 5.4.52, 6.4.40, 7.4.12, 8.0.12
GHSA-qpmx-3rfj-7rhv · CVE-2026-45067 - CVSS 6.5 Medium
pam_usb: XPath injection via PAM-supplied identifiers in pam_usb configuration queries
- mcdope pam_usb
- Other injection
- CVSS 5.3 Medium
itsourcecode Courier Management System parcel_list.php sql injection
- itsourcecode Courier Management System
- Other injection
- SQL injection
- CVSS 4.3 Medium
Yamcs Vulnerable to LDAP Injection in LdapAuthModule
- Other injection
<5.12.7 · fixed in 5.12.7
GHSA-cqh3-jg8p-336j · CVE-2026-42568