# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first - [FTS3 Web Monitoring 3.12.0 through 3.13.2 and 3.14.0 SQL Injection via /linkinfo](https://agentprime.io/advisories/CVE-2025-71458.md) `CVE-2025-71458` · CVE record: cern-fts fts-monitoring · CVSS 8.7 High · Not analysed yet · Published 6 Nov 2026 · Tags: SQL injection - [Subnet Solutions PowerSYSTEM Center SQL Injection](https://agentprime.io/advisories/CVE-2026-63774.md) `CVE-2026-63774` · CVE record: Subnet Solutions PowerSYSTEM Center 2024 and 1 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Nov 2026 · Tags: SQL injection - [Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server](https://agentprime.io/advisories/CVE-2026-88985.md) `CVE-2026-88985` · CVE record: kubeflow pipelines · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection - [SQL injection in the push notification handler of the MatchPoint Android app](https://agentprime.io/advisories/CVE-2026-111492.md) `CVE-2026-111492` · CVE record: TPC Software Matchpoint · CVSS 8.6 High · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection - [SuiteCRM: Authenticated SQL Injection In action_get_end_date function](https://agentprime.io/advisories/CVE-2026-100359.md) `CVE-2026-100359` · CVE record: SuiteCRM SuiteCRM · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection - [SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list](https://agentprime.io/advisories/CVE-2026-97377.md) `CVE-2026-97377` · CVE record: SuiteCRM SuiteCRM · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection - [SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User](https://agentprime.io/advisories/CVE-2026-100365.md) `CVE-2026-100365` · CVE record: SuiteCRM SuiteCRM · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection, Other injection - [SuiteCRM: Authenticated SQL Injection in AOR_Reports \`parameter_value\` (value_type=Field) allows any low-privileged user to read the full database](https://agentprime.io/advisories/CVE-2026-71548.md) `CVE-2026-71548` · CVE record: SuiteCRM SuiteCRM · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection, CWE-20 - [SuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship Management](https://agentprime.io/advisories/CVE-2026-69134.md) `CVE-2026-69134` · CVE record: SuiteCRM SuiteCRM · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection - [SuiteCRM: SQL injection via search param in modules/Cases/controller.php](https://agentprime.io/advisories/CVE-2026-69141.md) `CVE-2026-69141` · CVE record: SuiteCRM SuiteCRM · CVSS 8.3 High · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection - [SuiteCRM: Authenticated SQL Injection in map_markers distance Parameter](https://agentprime.io/advisories/CVE-2026-69142.md) `CVE-2026-69142` · CVE record: SuiteCRM SuiteCRM · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection - [SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.php](https://agentprime.io/advisories/CVE-2026-69140.md) `CVE-2026-69140` · CVE record: SuiteCRM SuiteCRM · CVSS 8.3 High · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection - [SuiteCRM: AOR Reports aor_fields.field SQL Injection](https://agentprime.io/advisories/CVE-2026-69145.md) `CVE-2026-69145` · CVE record: SuiteCRM SuiteCRM · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection - [SuiteCRM: Authenticated SQL Injection In handleAttachments function](https://agentprime.io/advisories/CVE-2026-69136.md) `CVE-2026-69136` · CVE record: SuiteCRM SuiteCRM · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection - [SuiteCRM: Authenticated SQL Injection In Project Module](https://agentprime.io/advisories/CVE-2026-69135.md) `CVE-2026-69135` · CVE record: SuiteCRM SuiteCRM · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection - [SuiteCRM: SQL injection via parameter_value\[0\] param in AOR_Report.php](https://agentprime.io/advisories/CVE-2026-61648.md) `CVE-2026-61648` · CVE record: SuiteCRM SuiteCRM · CVSS 8.3 High · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection - [SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.php](https://agentprime.io/advisories/CVE-2026-61653.md) `CVE-2026-61653` · CVE record: SuiteCRM SuiteCRM · CVSS 8.3 High · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection - [SuiteCRM: Time-Based Blind SQL Injection via REST API](https://agentprime.io/advisories/CVE-2026-63215.md) `CVE-2026-63215` · CVE record: SuiteCRM SuiteCRM · CVSS 8.3 High · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection - [SuiteCRM: Authenticated SQL Injection in v4_1 get_entry_list rest api](https://agentprime.io/advisories/CVE-2026-63214.md) `CVE-2026-63214` · CVE record: SuiteCRM SuiteCRM · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection, Other injection - [SuiteCRM: Authenticated SQL Injection in get_end_date function in Project Controller](https://agentprime.io/advisories/CVE-2026-61651.md) `CVE-2026-61651` · CVE record: SuiteCRM SuiteCRM · CVSS 8.3 High · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection - [SQL injection in Trellix DLP on-prem extensions](https://agentprime.io/advisories/CVE-2026-115738.md) `CVE-2026-115738` · CVE record: Trellix DLP on-prem extensions · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection - [Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB](https://agentprime.io/advisories/CVE-2026-81815.md) `CVE-2026-81815` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection - [itsourcecode Online Book Store admin_edit.php sql injection](https://agentprime.io/advisories/CVE-2026-123028.md) `CVE-2026-123028` · CVE record: itsourcecode Online Book Store · CVSS 6.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Other injection, SQL injection - [SQL Injection in Kobikom Telecommunications' Kobikom](https://agentprime.io/advisories/CVE-2026-105321.md) `CVE-2026-105321` · CVE record: Kobikom Telecommunications and Informatics Services Inc. Kobikom · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection - [itsourcecode Airline Reservation System manage_booked.php sql injection](https://agentprime.io/advisories/CVE-2026-122191.md) `CVE-2026-122191` · CVE record: itsourcecode Airline Reservation System · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Other injection, SQL injection - [Campcodes Complete Sales and Inventory System with Credit Management login.php sql injection](https://agentprime.io/advisories/CVE-2026-122050.md) `CVE-2026-122050` · CVE record: Campcodes Complete Sales and Inventory System with Credit Management · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Other injection, SQL injection - [Campcodes Division Regional Athletic Meet Game Result Matrix System check-user.php sql injection](https://agentprime.io/advisories/CVE-2026-122048.md) `CVE-2026-122048` · CVE record: Campcodes Division Regional Athletic Meet Game Result Matrix System · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Other injection, SQL injection - [krupalshah EmployeeRecruitmentSystem Requirement Board Update reqformprocessing.php mysql_query sql injection](https://agentprime.io/advisories/CVE-2026-122038.md) `CVE-2026-122038` · CVE record: krupalshah EmployeeRecruitmentSystem · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Other injection, SQL injection - [GLPI: Blind Time based SQLI in dropdowns](https://agentprime.io/advisories/CVE-2026-47678.md) `CVE-2026-47678` · CVE record: glpi-project glpi · CVSS 8.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: SQL injection - [vtenext before 25.02.2 SQL Injection via fieldname in Fax EditView](https://agentprime.io/advisories/CVE-2025-71456.md) `CVE-2025-71456` · CVE record: vtenext vtenext · CVSS 8.6 High · Not analysed yet · Published 4 Nov 2026 · Tags: SQL injection - [Nexus Repository 3 - SQL Injection in Reindex Search by Pattern Task](https://agentprime.io/advisories/CVE-2026-113370.md) `CVE-2026-113370` · CVE record: Sonatype Nexus Repository 3 · CVSS 7.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: SQL injection - [SPIP before 4.4.29 Authenticated SQL Injection via where Parameter](https://agentprime.io/advisories/CVE-2026-122032.md) `CVE-2026-122032` · CVE record: SPIP SPIP · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: SQL injection - [SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func](https://agentprime.io/advisories/CVE-2026-121009.md) `CVE-2026-121009` · CVE record · No CVSS score · Not analysed yet · Published 4 Nov 2026 · Tags: SQL injection - [SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position](https://agentprime.io/advisories/CVE-2026-121007.md) `CVE-2026-121007` · CVE record · No CVSS score · Not analysed yet · Published 4 Nov 2026 · Tags: SQL injection - [Duplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During Restore](https://agentprime.io/advisories/CVE-2026-115262.md) `CVE-2026-115262` · CVE record: Unknown Duplicator and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: SQL injection - [funadmin Frontend List Endpoint index selectList sql injection](https://agentprime.io/advisories/CVE-2026-121610.md) `CVE-2026-121610` · CVE record: funadmin · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Other injection, SQL injection - [RosarioSIS before 12.9 SQL Injection via period_id in Attendance Absence Report](https://agentprime.io/advisories/CVE-2026-121731.md) `CVE-2026-121731` · CVE record: francoisjacquet RosarioSIS · CVSS 8.7 High · Not analysed yet · Published 3 Nov 2026 · Tags: SQL injection - [sumiie24 School-Management-System Public Search Feature parent_Login.php sql injection](https://agentprime.io/advisories/CVE-2026-121524.md) `CVE-2026-121524` · CVE record: sumiie24 School-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project facultydetails.php sql injection](https://agentprime.io/advisories/CVE-2026-121502.md) `CVE-2026-121502` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Other injection, SQL injection - [Chamilo LMS: Blind SQL Injection in model.ajax.php via filters\[groupOp\] authentificated](https://agentprime.io/advisories/CVE-2026-45146.md) `CVE-2026-45146` · CVE record: chamilo chamilo-lms · CVSS 7.2 High · Not analysed yet · Published 3 Nov 2026 · Tags: SQL injection - [Elo backends have code injection via unvalidated emission of programmatic AST fields](https://agentprime.io/advisories/GHSA-x9rp-7wh3-2rj5.md) `GHSA-x9rp-7wh3-2rj5`, `CVE-2026-44265` · npm `@enspirit/elo`: affected `<1.0.1`, fixed in `1.0.1` · CVSS 7.4 High · Not analysed yet · Published 3 Nov 2026 · Tags: SQL injection, Code injection, CWE-20, CWE-749 - [SQL injection in SonicWall Global Management System (GMS)](https://agentprime.io/advisories/CVE-2026-109594.md) `CVE-2026-109594` · CVE record: SonicWall Global Management System (GMS) · CVSS 6.8 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: SQL injection - [SQL injection in NVIDIA Slurm](https://agentprime.io/advisories/CVE-2026-65139.md) `CVE-2026-65139` · CVE record: NVIDIA Slurm · CVSS 6.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: SQL injection - [runZero search SQL injection](https://agentprime.io/advisories/CVE-2026-110265.md) `CVE-2026-110265` · CVE record: runZero Platform · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: SQL injection - [WPML Multilingual & Multicurrency for WooCommerce <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection via Exchange Rate Field](https://agentprime.io/advisories/CVE-2026-120563.md) `CVE-2026-120563` · CVE record: amirhelzer WPML Multilingual & Multicurrency for WooCommerce · CVSS 4.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: SQL injection - [Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter](https://agentprime.io/advisories/CVE-2026-120558.md) `CVE-2026-120558` · CVE record: zorem Advanced Shipment Tracking for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 3 Nov 2026 · Tags: SQL injection - [SQL injection in Google Android](https://agentprime.io/advisories/CVE-2026-58821.md) `CVE-2026-58821` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: SQL injection - [psqlODBC does not escape a server-supplied column name in its updatable-cursor queries](https://agentprime.io/advisories/CVE-2026-120065.md) `CVE-2026-120065` · CVE record: PostgreSQL psqlODBC · CVSS 7.1 High · Not analysed yet · Published 2 Nov 2026 · Tags: SQL injection - [psqlODBC SQL injection through SQLSpecialColumns table and schema names](https://agentprime.io/advisories/CVE-2026-120062.md) `CVE-2026-120062` · CVE record: PostgreSQL psqlODBC · CVSS 7.5 High · Not analysed yet · Published 2 Nov 2026 · Tags: SQL injection - [Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3](https://agentprime.io/advisories/CVE-2026-105604.md) `CVE-2026-105604` · CVE record: dj-extensions.com DJ-Classifieds extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: SQL injection - [Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas](https://agentprime.io/advisories/CVE-2026-119301.md) `CVE-2026-119301` · CVE record: AWS aws-sdk-pandas · CVSS 5.0 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: SQL injection, CWE-149 - [Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter](https://agentprime.io/advisories/CVE-2026-77881.md) `CVE-2026-77881` · CVE record: Control Web Panel Control Web Panel · CVSS 6.8 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: SQL injection - [Control Web Panel (CWP) < 1.16 SQL Injection via access_token() API](https://agentprime.io/advisories/CVE-2026-77879.md) `CVE-2026-77879` · CVE record: Control Web Panel Control Web Panel · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: SQL injection - [OwnTone Server through 29.3 SQL Injection via MPD sticker find Command](https://agentprime.io/advisories/CVE-2026-120441.md) `CVE-2026-120441` · CVE record: OwnTone OwnTone Server · CVSS 6.9 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: SQL injection - [SQL Injection in Starnet Computer Systems' Inventory Tracking Application](https://agentprime.io/advisories/CVE-2026-74993.md) `CVE-2026-74993` · CVE record: Starnet Computer and Network Systems Inventory Tracking Application · CVSS 7.5 High · Not analysed yet · Published 2 Nov 2026 · Tags: SQL injection - [Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search](https://agentprime.io/advisories/CVE-2026-114364.md) `CVE-2026-114364` · CVE record: Apache Software Foundation Apache Syncope · No CVSS score · Not analysed yet · Published 2 Nov 2026 · Tags: SQL injection - [SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption](https://agentprime.io/advisories/CVE-2026-2613.md) `CVE-2026-2613` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 8.7 High · Not analysed yet · Published 2 Nov 2026 · Tags: SQL injection - [SQL Injection vulnerability in ZTE ElasticNet RNIA R18 NGI product](https://agentprime.io/advisories/CVE-2026-118871.md) `CVE-2026-118871` · CVE record: ZTE ElasticNet RNIA R18 NGI · CVSS 6.5 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: SQL injection - [dayrui XunRuiCMS Member View.php View sql injection](https://agentprime.io/advisories/CVE-2026-120347.md) `CVE-2026-120347` · CVE record: dayrui XunRuiCMS · CVSS 6.9 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project viewquery.php sql injection](https://agentprime.io/advisories/CVE-2026-120342.md) `CVE-2026-120342` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Other injection, SQL injection Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .