Other injection.

MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection

• MaxSite CMS
• Other injection
• Code injection

OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth)

• Other injection
• Code injection

<2026.2.21 · fixed in 2026.2.21

calibre Vulnerable to HTTP Response Header Injection

• kovidgoyal calibre
• Other injection

jizhiCMS Batch Model.php findAll sql injection

• jizhiCMS
• Other injection
• SQL injection

youlaitech youlai-mall App-side Product Pagination Endpoint SpuController.java listPagedSpuForApp sql injection

• youlaitech youlai-mall
• Other injection
• SQL injection

Koa has Host Header Injection via ctx.hostname

• Other injection
• CWE-20

<2.16.4 || >=3.0.0, <3.1.2 · fixed in 2.16.4, 3.1.2

Arbitrary code execution in log reader via untrusted log file

• CyrilleB79 NVDA-Dev-Test-Toolbox
• Other injection

itsourcecode School Management System Setting index.php sql injection

• itsourcecode School Management System
• Other injection
• SQL injection

Storybook Dev Server is Vulnerable to WebSocket Hijacking

• Other injection
• Cross-site scripting (XSS)

>=8.1.0, <8.6.17 || >=8.7.0-alpha.0, <9.1.19 || >=10.0.0-beta.0, <10.2.10 · fixed in 8.6.17, 9.1.19, 10.2.10

Gvfs: ftp gvfs backend: arbitrary ftp command injection via crlf sequences in file paths

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Other injection

z-9527 admin user.js getUsers sql injection

• z-9527 admin
• Other injection
• SQL injection

mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

• Other injection
• Insecure deserialization

<0.4.0 · fixed in 0.4.0

itsourcecode News Portal Project contactus.php sql injection

• itsourcecode News Portal Project
• Other injection
• SQL injection

itsourcecode Document Management System register.php sql injection

• itsourcecode Document Management System
• Other injection
• SQL injection

itsourcecode College Management System teacher-salary.php sql injection

• itsourcecode College Management System
• Other injection
• SQL injection

itsourcecode College Management System login.php sql injection

• itsourcecode College Management System
• Other injection
• SQL injection

itsourcecode College Management System display-teacher.php sql injection

• itsourcecode College Management System
• Other injection
• SQL injection

itsourcecode College Management System asign-single-student-subjects.php sql injection

• itsourcecode College Management System
• Other injection
• SQL injection

SourceCodester Simple and Nice Shopping Cart Script signup.php sql injection

• SourceCodester Simple and Nice Shopping Cart Script
• Other injection
• SQL injection

itsourcecode News Portal Project add-category.php sql injection

• itsourcecode News Portal Project
• Other injection
• SQL injection

itsourcecode News Portal Project edit-category.php sql injection

• itsourcecode News Portal Project
• Other injection
• SQL injection

itsourcecode Document Management System Login loging.php sql injection

• itsourcecode Document Management System
• Other injection
• SQL injection

itsourcecode Document Management System edtlbls.php sql injection

• itsourcecode Document Management System
• Other injection
• SQL injection

itsourcecode Document Management System deluser.php sql injection

• itsourcecode Document Management System
• Other injection
• SQL injection

HummerRisk Cloud Compliance Scanning PlatformUtils.java fixedCommand command injection

• HummerRisk
• Other injection
• Command injection

HummerRisk Cloud Task Dry-run CloudTaskService.java CommandUtils.commonExecCmdWithResult command injection

• HummerRisk
• Other injection
• Command injection

HummerRisk Cloud Task Scheduler ResourceCreateService.java command injection

• HummerRisk
• Other injection
• Command injection

a54552239 pearProjectApi Backend Task.php dateTotalForProject sql injection

• a54552239 pearProjectApi
• Other injection
• SQL injection

itsourcecode E-Logbook with Health Monitoring System for COVID-19 check_profile_old.php sql injection

• itsourcecode E-Logbook with Health Monitoring System for COVID-19
• Other injection
• SQL injection

itsourcecode Event Management System index.php sql injection

• itsourcecode Event Management System
• Other injection
• SQL injection

New API has an SQL LIKE Wildcard Injection DoS via Token Search

• Other injection

<0.10.8-alpha.10 · fixed in 0.10.8-alpha.10

Valkey Affected by RESP Protocol Injection via Lua error_reply

• valkey
• Other injection
• CWE-170

Jinher OA C6 OfficeSupplyTypeRight.aspx sql injection

• Jinher OA C6
• Other injection
• SQL injection

qinming99 dst-admin restore revertBackup command injection

• qinming99 dst-admin
• Other injection
• Command injection

Dromara UJCMS ImportDataController import-channel importChanel injection

• Dromara UJCMS
• Other injection
• CWE-707

code-projects Online Reviewer System studentresult-view.php sql injection

• code-projects Online Reviewer System
• Other injection
• SQL injection

itsourcecode Vehicle Management System billaction.php sql injection

• itsourcecode Vehicle Management System
• Other injection
• SQL injection

itsourcecode Agri-Trading Online Shopping System HTTP POST Request productcontroller.php sql injection

• itsourcecode Agri-Trading Online Shopping System
• Other injection
• SQL injection

SourceCodester Simple Responsive Tourism Website Registration Master.php sql injection

• SourceCodester Simple Responsive Tourism Website
• Other injection
• SQL injection

Comfast CF-E7 webmggnt mbox-config sub_441CF4 command injection

• Comfast CF-E7
• Other injection
• Command injection

Comfast CF-E7 webmggnt mbox-config sub_41ACCC command injection

• Comfast CF-E7
• Other injection
• Command injection

JeecgBoot Backend airag_app,1,create_by sql injection

• JeecgBoot
• Other injection
• SQL injection

Fujian Smart Integrated Management Platform System XCamera.ashx sql injection

• Fujian Smart Integrated Management Platform System
• Other injection
• SQL injection

Fujian Smart Integrated Management Platform System XAccessPermissionPlus.ashx sql injection

• Fujian Smart Integrated Management Platform System
• Other injection
• SQL injection

D-Tale affected by Remote Code Execution through the /save-column-filter endpoint

• Other injection

<3.20.0 · fixed in 3.20.0

eBay API MCP Server Affected by Environment Variable Injection

• Other injection
• CWE-15

<=1.7.2 · no fixed version yet

code-projects Patient Record Management System fecalysis_not.php sql injection

• code-projects Patient Record Management System
• Other injection
• SQL injection

itsourcecode Event Management System manage_register.php sql injection

• itsourcecode Event Management System
• Other injection
• SQL injection

itsourcecode Event Management System Admin Login ajax.php sql injection

• itsourcecode Event Management System
• Other injection
• SQL injection

itsourcecode Event Management System manage_booking.php sql injection

• itsourcecode Event Management System
• Other injection
• SQL injection

InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning

• InvoicePlane
• Code injection
• File inclusion

RediSearch Query Injection in @langchain/langgraph-checkpoint-redis

• Other injection

<1.0.2 · fixed in 1.0.2

Tsinghua Unigroup Electronic Archives System prinReport.html sql injection

• Tsinghua Unigroup Electronic Archives System
• Other injection
• SQL injection

Alixhan xh-admin-backend Database Query query sql injection

• Alixhan xh-admin-backend
• Other injection
• SQL injection

Cart All In One For WooCommerce <= 1.1.21 - Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting

• villatheme Cart All In One For WooCommerce
• Other injection

ShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action

• devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
• Other injection

OpenClaw log poisoning (indirect prompt injection) via WebSocket headers

• Other injection

<2026.2.13 · fixed in 2026.2.13

Sciyon Koyuan Thermoelectricity Heat Network Management System AsyncTreeProxy.aspx sql injection

• Sciyon Koyuan Thermoelectricity Heat Network Management System
• Other injection
• SQL injection

Huace Monitoring and Early Warning System ProjectRole.aspx sql injection

• Huace Monitoring and Early Warning System
• Other injection
• SQL injection

Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

• IBM MQ Operator
• IBM supplied MQ Advanced container images
• Other injection