Advisories · Weakness
Other injection.
LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.3 Medium
kishor-23 food-waste-management-system Order Assignment Block admin.php sql injection
- kishor-23 food-waste-management-system
- Other injection
- SQL injection
- CVSS 6.9 Medium
kishor-23 food-waste-management-system donate.php sql injection
- kishor-23 food-waste-management-system
- Other injection
- SQL injection
- CVSS 6.9 Medium
kishor-23 food-waste-management-system Food Donation Form fooddonateform.php insert sql injection
- kishor-23 food-waste-management-system
- Other injection
- SQL injection
- CVSS 6.9 Medium
RainyGao DocSys Database Management BaseController.java BaseController.createDBForMysql sql injection
- RainyGao DocSys
- Other injection
- SQL injection
- CVSS 6.9 Medium
mooSocial all-products sql injection
- mooSocial
- Other injection
- SQL injection
- CVSS 5.1 Medium
Comsenz Discuz! Admin Medal Moderation mod.php modmedalsubmit sql injection
- Comsenz Discuz!
- Other injection
- SQL injection
- CVSS 10.0 CriticalCritical · CVSS 9+
InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection
- InternLM MindSearch
- Other injection
- Code injection
- CVSS 6.5 Medium
All in One SEO < 5.0.2.1 - Unauthenticated Arbitrary Shortcode Execution via Search Query
- All in One SEO
- Other injection
- CVSS 5.3 Medium
CodeAstro Simple Loan Management System index.php sql injection
- CodeAstro Simple Loan Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
CodeAstro Simple Pharmacy Management System delete.php sql injection
- CodeAstro Simple Pharmacy Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
CodeAstro Simple Pharmacy Management System view.php sql injection
- CodeAstro Simple Pharmacy Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
onetwothreeneth HospitalManagementSystem edit_accounts.php get sql injection
- onetwothreeneth HospitalManagementSystem
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Online Admission System Project confirm.php sql injection
- itsourcecode Online Admission System Project
- Other injection
- SQL injection
- CVSS 5.4 Medium
Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbitrary Shortcode Execution via get_addon_output_data
- Unlimited Elements for Elementor
- Other injection
- CVSS 6.5 Medium
The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' Parameter
- The Events Calendar
- Other injection
- CVSS 6.9 Medium
SourceCodester Online Reviewer Management System btn_functions.php activity sql injection
- SourceCodester Online Reviewer Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Pet Shop Management System admin_reservefilter.php sql injection
- itsourcecode Pet Shop Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Pet Shop Management System admin_reject_completed.php sql injection
- itsourcecode Pet Shop Management System
- Other injection
- SQL injection
- CVSS 7.1 High
djehuty: Unauthenticated SPARQL injection in the search API (`order`, `operator`, `key`)
- 4TUResearchData djehuty
- Other injection
- CVSS 8.4 High
djehuty: Authenticated SPARQL injection in session editing allows writing arbitrary RDF triples
- 4TUResearchData djehuty
- Other injection
- CVSS 5.3 Medium
itsourcecode Leave Management System controller.php sql injection
- itsourcecode Leave Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation
- n8n
- Other injection
- CVSS 7.0 High
n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory
- n8n
- Other injection
- CVSS 5.3 Medium
itsourcecode Leave Management System controller.php sql injection
- itsourcecode Leave Management System
- Other injection
- SQL injection
- CVSS 5.8 Medium
virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection
- Other injection
<21.7.11 · fixed in 21.7.11
GHSA-9h9j-4vrj-gf7g · CVE-2026-102938 - CVSS 7.2 High
Kiteworks Email Protection Gateway Path Traversal
- Kiteworks Email Protection Gateway
- Path traversal
- Other injection
- CVSS 6.3 Medium
Kiteworks Core Command Execution through Configuration Injection
- Kiteworks Core
- Other injection
- CVSS 6.6 Medium
Kiteworks Core Server-Side Request Forgery through CRLF Injection
- Kiteworks Core
- Other injection
- CVSS 6.9 Medium
AdithyaYelloju Restaurant-Management-System table_booking.php mysqli_query sql injection
- AdithyaYelloju Restaurant-Management-System
- Other injection
- SQL injection
- CVSS 6.9 Medium
AdithyaYelloju Restaurant-Management-System Order Cancellation cancel.php mysqli_query sql injection
- AdithyaYelloju Restaurant-Management-System
- Other injection
- SQL injection
- CVSS 6.9 Medium
Axios: Header Injection via Inherited headers After Minimal Interceptor
- Other injection
- Prototype pollution
>=1.0.0, <1.20.0 · fixed in 1.20.0
GHSA-j8rh-479h-cp32 · CVE-2026-101904 - CVSS 6.9 Medium
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
- Other injection
- Prototype pollution
>=1.12.0, <1.20.0 · fixed in 1.20.0
GHSA-4hqw-qxg8-jxx2 · CVE-2026-101900 - CVSS 6.9 Medium
AdithyaYelloju Restaurant-Management-System Order Placement ord.php mysqli_query sql injection
- AdithyaYelloju Restaurant-Management-System
- Other injection
- SQL injection
- CVSS 6.9 Medium
AdithyaYelloju Restaurant-Management-System Unauthenticated Action Script delete1.php mysqli_query sql injection
- AdithyaYelloju Restaurant-Management-System
- Other injection
- SQL injection
- CVSS 5.1 Medium
OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection
- OS4ED openSIS-Classic
- Other injection
- SQL injection
- CVSS 5.3 Medium
OS4ED openSIS-Classic Student List Search Endpoint GetStuListFnc.php DBQuery sql injection
- OS4ED openSIS-Classic
- Other injection
- SQL injection
- CVSS 5.3 Medium
OS4ED openSIS-Classic Student Search CustomFieldsFnc.php sql injection
- OS4ED openSIS-Classic
- Other injection
- SQL injection
- CVSS 5.3 Medium
OS4ED openSIS-Classic Assignment Management Endpoint Assignments.php DBQuery_assignment sql injection
- OS4ED openSIS-Classic
- Other injection
- SQL injection
- CVSS 5.1 Medium
OS4ED openSIS-Classic General Information Tab Student.php save action sql injection
- OS4ED openSIS-Classic
- Other injection
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache MINA SSHD: LDAP injection in sshd-ldap
- Apache Software Foundation Apache MINA SSHD
- Other injection
- CWE-305
- CVSS 6.9 Medium
SourceCodester Car Driving School Management System Master.php save_enrollment sql injection
- SourceCodester Car Driving School Management System
- Other injection
- SQL injection
- CVSS 5.1 Medium
SourceCodester Online Leave Management System page reports sql injection
- SourceCodester Online Leave Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Online Reviewer Management System exam-delete.php sql injection
- SourceCodester Online Reviewer Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Online Reviewer Management System btn_functions.php sql injection
- SourceCodester Online Reviewer Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Online Reviewer Management System questions-view.php sql injection
- SourceCodester Online Reviewer Management System
- Other injection
- SQL injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Ziroom ZHOME A0101 ping command injection
- Ziroom ZHOME A0101
- Other injection
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Ziroom ZHOME A0101 set_time_zone command injection
- Ziroom ZHOME A0101
- Other injection
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
EasyTimeline should not serve image maps as application/xml
- The Wikimedia Foundation Mediawiki - EasyTimeline extension
- Path traversal
- Other injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Ziroom ZHOME A0101 set_syslog command injection
- Ziroom ZHOME A0101
- Other injection
- Command injection
- CVSS 6.9 Medium
risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection
- risesoft-y9 WorkFlow-Engine
- Other injection
- SQL injection
- CVSS 6.9 Medium
mahonelau kykms SqlInjectionUtil QueryGenerator.java QueryGenerator.doMultiFieldsOrder sql injection
- mahonelau kykms
- Other injection
- SQL injection
- CVSS 8.7 High
TIBCO Administrator Injection Vulnerability
- Tibco Administrator
- Other injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox
- psyb0t docker-mailbox
- Other injection
- CVSS 4.3 Medium
Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that ...
- Other injection
<22.6.0 · fixed in 22.6.0
PYSEC-2026-4187 · CVE-2026-81914 - CVSS 5.3 Medium
MODSetter SurfSense MCP Connector Integration test command injection
- MODSetter SurfSense
- Other injection
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Ziroom ZHOME A0101 set_passwd command injection
- Ziroom ZHOME A0101
- Other injection
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Ziroom ZHOME A0101 set_online_client command injection
- Ziroom ZHOME A0101
- Other injection
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Ziroom ZHOME A0101 set_online_client command injection
- Ziroom ZHOME A0101
- Other injection
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Ziroom ZHOME A0101 firstSetup_wifi command injection
- Ziroom ZHOME A0101
- Other injection
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Ziroom ZHOME A0101 firstLogin command injection
- Ziroom ZHOME A0101
- Other injection
- Command injection