# SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [code-projects Simple Laundry System userchecklogin.php sql injection](https://agentprime.io/advisories/CVE-2026-5824.md)
  `CVE-2026-5824` · CVE record: code-projects Simple Laundry System · CVSS 6.9 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Other injection, SQL injection
- [itsourcecode Construction Management System borrowed_tool_report.php sql injection](https://agentprime.io/advisories/CVE-2026-5823.md)
  `CVE-2026-5823` · CVE record: itsourcecode Construction Management System · CVSS 5.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Other injection, SQL injection
- [PHPGurukul Online Course Registration check_availability.php sql injection](https://agentprime.io/advisories/CVE-2026-5814.md)
  `CVE-2026-5814` · CVE record: PHPGurukul Online Course Registration · CVSS 6.9 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Other injection, SQL injection
- [PHPGurukul Online Course Registration check_availability.php sql injection](https://agentprime.io/advisories/CVE-2026-5813.md)
  `CVE-2026-5813` · CVE record: PHPGurukul Online Course Registration · CVSS 6.9 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Easy Blog Site contact_us.php sql injection](https://agentprime.io/advisories/CVE-2026-5805.md)
  `CVE-2026-5805` · CVE record: code-projects Easy Blog Site · CVSS 6.9 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Other injection, SQL injection
- [LORIS has a SQL injection in MRI feedback popup](https://agentprime.io/advisories/CVE-2026-33350.md)
  `CVE-2026-33350` · CVE record: aces Loris · CVSS 7.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: SQL injection
- [WCAPF – WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL Injection](https://agentprime.io/advisories/CVE-2026-3396.md)
  `CVE-2026-3396` · CVE record: shamimmoeen WCAPF – Ajax Product Filter for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: SQL injection
- [User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids\[\]](https://agentprime.io/advisories/CVE-2026-1865.md)
  `CVE-2026-1865` · CVE record: wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder · CVSS 6.5 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: SQL injection
- [SQL injection in Six Apart Ltd. Movable Type and others](https://agentprime.io/advisories/CVE-2026-33088.md)
  `CVE-2026-33088` · CVE record: Six Apart Ltd. Movable Type and 4 more · CVSS 6.9 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: SQL injection
- [WordPress FOX plugin <= 1.4.5 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39497.md)
  `CVE-2026-39497` · CVE record: RealMag777 FOX · CVSS 7.6 High · Not analysed yet · Published 8 Apr 2026 · Tags: SQL injection
- [WordPress YayMail plugin <= 4.3.3 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39496.md)
  `CVE-2026-39496` · CVE record: YayCommerce YayMail · CVSS 7.6 High · Not analysed yet · Published 8 Apr 2026 · Tags: SQL injection
- [WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39495.md)
  `CVE-2026-39495` · CVE record: NSquared Simply Schedule Appointments · CVSS 8.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: SQL injection
- [WordPress Amelia plugin <= 2.1.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39487.md)
  `CVE-2026-39487` · CVE record: ameliabooking Amelia · CVSS 7.6 High · Not analysed yet · Published 8 Apr 2026 · Tags: SQL injection
- [WordPress Download Monitor plugin <= 5.1.8 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39486.md)
  `CVE-2026-39486` · CVE record: WP Chill Download Monitor · CVSS 8.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: SQL injection
- [WordPress OttoKit plugin <= 1.1.20 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39479.md)
  `CVE-2026-39479` · CVE record: Brainstorm Force OttoKit · CVSS 7.6 High · Not analysed yet · Published 8 Apr 2026 · Tags: SQL injection
- [WordPress User Feedback plugin <= 1.10.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39475.md)
  `CVE-2026-39475` · CVE record: Syed Balkhi User Feedback · CVSS 7.6 High · Not analysed yet · Published 8 Apr 2026 · Tags: SQL injection
- [WordPress Broken Link Checker plugin <= 2.4.7 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39466.md)
  `CVE-2026-39466` · CVE record: WPMU DEV - Your All-in-One WordPress Platform Broken Link Checker · CVSS 7.6 High · Not analysed yet · Published 8 Apr 2026 · Tags: SQL injection
- [Attendance Manager <= 0.6.2 - Authenticated (Subscriber+) SQL Injection via 'attmgr_off' Parameter](https://agentprime.io/advisories/CVE-2026-3781.md)
  `CVE-2026-3781` · CVE record: tnomi Attendance Manager · CVSS 5.4 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: SQL injection
- [SQL injection in ICZ Corporation MATCHA INVOICE](https://agentprime.io/advisories/CVE-2026-24913.md)
  `CVE-2026-24913` · CVE record: ICZ Corporation MATCHA INVOICE · CVSS 8.7 High · Not analysed yet · Published 8 Apr 2026 · Tags: SQL injection
- [Drizzle ORM has SQL injection via improperly escaped SQL identifiers](https://agentprime.io/advisories/GHSA-gpj5-g38j-94v9.md)
  `GHSA-gpj5-g38j-94v9`, `CVE-2026-39356` · npm `drizzle-orm`: affected `<0.45.2 || >=1.0.0-beta.2, <1.0.0-beta.20`, fixed in `0.45.2`, `1.0.0-beta.20` · CVSS 7.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: SQL injection
- [PowerJob vulnerable to SQL injection](https://agentprime.io/advisories/GHSA-4fp2-3xgg-jg4w.md)
  `GHSA-4fp2-3xgg-jg4w`, `CVE-2026-5736` · Maven `tech.powerjob:powerjob-server-starter`: affected `>=5.1.0, <=5.1.2`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: Other injection, SQL injection
- [ChurchCRM has a Second Order SQLI via FundRaiserEditor.php](https://agentprime.io/advisories/CVE-2026-39319.md)
  `CVE-2026-39319` · CVE record: ChurchCRM CRM · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: SQL injection
- [ChurchCRM has a SQL Injection in Event Type Editor (Admin)](https://agentprime.io/advisories/CVE-2026-39343.md)
  `CVE-2026-39343` · CVE record: ChurchCRM CRM · CVSS 7.2 High · Not analysed yet · Published 7 Apr 2026 · Tags: SQL injection
- [ChurchCRM has a SQL injection searchwhat parameter via QueryView.php](https://agentprime.io/advisories/CVE-2026-39342.md)
  `CVE-2026-39342` · CVE record: ChurchCRM CRM · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Apr 2026 · Tags: SQL injection
- [SQL injection in ChurchCRM.0](https://agentprime.io/advisories/CVE-2026-39341.md)
  `CVE-2026-39341` · CVE record: ChurchCRM CRM · CVSS 8.1 High · Not analysed yet · Published 7 Apr 2026 · Tags: SQL injection
- [ChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer Substitution](https://agentprime.io/advisories/CVE-2026-39340.md)
  `CVE-2026-39340` · CVE record: ChurchCRM CRM · CVSS 8.1 High · Not analysed yet · Published 7 Apr 2026 · Tags: SQL injection
- [ChurchCRM has a Blind SQL injection in SettingsIndividual.php](https://agentprime.io/advisories/CVE-2026-39334.md)
  `CVE-2026-39334` · CVE record: ChurchCRM CRM · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: SQL injection
- [ChurchCRM has a Blind SQL injection in PropertyAssign.php](https://agentprime.io/advisories/CVE-2026-39330.md)
  `CVE-2026-39330` · CVE record: ChurchCRM CRM · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: SQL injection
- [ChurchCRM has a Blind SQL injection in EventNames.php](https://agentprime.io/advisories/CVE-2026-39329.md)
  `CVE-2026-39329` · CVE record: ChurchCRM CRM · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: SQL injection
- [ChurchCRM has a SQL injection in MemberRoleChange.php](https://agentprime.io/advisories/CVE-2026-39327.md)
  `CVE-2026-39327` · CVE record: ChurchCRM CRM · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: SQL injection
- [ChurchCRM has a Blind SQL injection in PropertyTypeEditor.php](https://agentprime.io/advisories/CVE-2026-39326.md)
  `CVE-2026-39326` · CVE record: ChurchCRM CRM · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: SQL injection
- [ChurchCRM has a Blind SQL injection in SettingsUser.php](https://agentprime.io/advisories/CVE-2026-39325.md)
  `CVE-2026-39325` · CVE record: ChurchCRM CRM · CVSS 7.2 High · Not analysed yet · Published 7 Apr 2026 · Tags: SQL injection
- [ChurchCRM has a DDL SQL Injection in GroupPropsFormRowOps.php](https://agentprime.io/advisories/CVE-2026-39318.md)
  `CVE-2026-39318` · CVE record: ChurchCRM CRM · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: SQL injection
- [Windmill < 1.603.3 File Ownership Handling SQLi RCE](https://agentprime.io/advisories/CVE-2026-23696.md)
  `CVE-2026-23696` · CVE record: Windmill Labs Windmill CE (Community Edition) and 1 more · CVSS 9.4 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.14 · Not analysed yet · Published 7 Apr 2026 · Tags: SQL injection
- [Frappe has a SQL injection in bulk_update](https://agentprime.io/advisories/CVE-2026-35614.md)
  `CVE-2026-35614` · CVE record: frappe frappe · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Apr 2026 · Tags: SQL injection
- [runZero Platform SQL injection in saved queries](https://agentprime.io/advisories/CVE-2026-5372.md)
  `CVE-2026-5372` · CVE record: runZero Platform · CVSS 6.4 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: SQL injection
- [itsourcecode Construction Management System borrowedtool.php sql injection](https://agentprime.io/advisories/CVE-2026-5719.md)
  `CVE-2026-5719` · CVE record: itsourcecode Construction Management System · CVSS 5.3 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: Other injection, SQL injection
- [The Send Basket functionality in Koha Library before 23.05.10 is susceptible to Time-Based SQL Injection because it fails to sanitize the POST parameter bib_list in /cgi-bin/koha/opac-sendbasket.pl,…](https://agentprime.io/advisories/CVE-2024-36058.md)
  `CVE-2024-36058` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Apr 2026 · Tags: SQL injection
- [WeGIA has a SQL Injection in DespachoDAO.php via id_memorando parameter](https://agentprime.io/advisories/CVE-2026-35395.md)
  `CVE-2026-35395` · CVE record: LabRedesCefetRJ WeGIA · CVSS 8.8 High · Not analysed yet · Published 6 Apr 2026 · Tags: SQL injection
- [EcclesiaCRM has a Critical SQL Injection](https://agentprime.io/advisories/CVE-2026-35184.md)
  `CVE-2026-35184` · CVE record: phili67 ecclesiacrm · CVSS 8.7 High · Not analysed yet · Published 6 Apr 2026 · Tags: SQL injection
- [itsourcecode sanitize or validate this input Parameter borrowedequip.php sql injection](https://agentprime.io/advisories/CVE-2026-5681.md)
  `CVE-2026-5681` · CVE record: itsourcecode sanitize or validate this input · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection
- [itsourcecode Construction Management System Parameter borrowed_tool.php sql injection](https://agentprime.io/advisories/CVE-2026-5675.md)
  `CVE-2026-5675` · CVE record: itsourcecode Construction Management System · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Simple IT Discussion Forum Parameter edit-category.php sql injection](https://agentprime.io/advisories/CVE-2026-5672.md)
  `CVE-2026-5672` · CVE record: code-projects Simple IT Discussion Forum · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection
- [Cyber-III Student-Management-System Parameter login.php sql injection](https://agentprime.io/advisories/CVE-2026-5669.md)
  `CVE-2026-5669` · CVE record: Cyber-III Student-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Online FIR System Login checklogin.php sql injection](https://agentprime.io/advisories/CVE-2026-5665.md)
  `CVE-2026-5665` · CVE record: code-projects Online FIR System · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection
- [WordPress Media LIbrary Assistant plugin <= 3.34 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-34885.md)
  `CVE-2026-34885` · CVE record: David Lingren Media LIbrary Assistant · CVSS 8.5 High · Not analysed yet · Published 6 Apr 2026 · Tags: SQL injection
- [GLPI has an Authenticated SQL Injection via log exports](https://agentprime.io/advisories/CVE-2026-29047.md)
  `CVE-2026-29047` · CVE record: glpi-project glpi · CVSS 7.2 High · Not analysed yet · Published 6 Apr 2026 · Tags: SQL injection
- [GLPI has an Unauthenticated SQL Injection via Search engine](https://agentprime.io/advisories/CVE-2026-26263.md)
  `CVE-2026-26263` · CVE record: glpi-project glpi · CVSS 8.1 High · Not analysed yet · Published 6 Apr 2026 · Tags: SQL injection
- [itsourcecode Construction Management System Parameter borrowed_equip.php sql injection](https://agentprime.io/advisories/CVE-2026-5660.md)
  `CVE-2026-5660` · CVE record: itsourcecode Construction Management System · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Online Application System for Admission Endpoint admsnform.php sql injection](https://agentprime.io/advisories/CVE-2026-5649.md)
  `CVE-2026-5649` · CVE record: code-projects Online Application System for Admission · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Simple Laundry System Parameter userfinishregister.php sql injection](https://agentprime.io/advisories/CVE-2026-5648.md)
  `CVE-2026-5648` · CVE record: code-projects Simple Laundry System · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Easy Blog Site login.php sql injection](https://agentprime.io/advisories/CVE-2026-5646.md)
  `CVE-2026-5646` · CVE record: code-projects Easy Blog Site · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection
- [projectworlds Car Rental System Parameter pay.php sql injection](https://agentprime.io/advisories/CVE-2026-5645.md)
  `CVE-2026-5645` · CVE record: projectworlds Car Rental System · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection
- [PHPGurukul Online Shopping Portal Project Parameter update-image1.php sql injection](https://agentprime.io/advisories/CVE-2026-5641.md)
  `CVE-2026-5641` · CVE record: PHPGurukul Online Shopping Portal Project · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection
- [PHPGurukul Online Shopping Portal Project Parameter update-image2.php sql injection](https://agentprime.io/advisories/CVE-2026-5640.md)
  `CVE-2026-5640` · CVE record: PHPGurukul Online Shopping Portal Project · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection
- [PHPGurukul Online Shopping Portal Project Parameter update-image3.php sql injection](https://agentprime.io/advisories/CVE-2026-5639.md)
  `CVE-2026-5639` · CVE record: PHPGurukul Online Shopping Portal Project · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection
- [projectworlds Car Rental System Parameter message_admin.php sql injection](https://agentprime.io/advisories/CVE-2026-5637.md)
  `CVE-2026-5637` · CVE record: projectworlds Car Rental System · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection
- [PHPGurukul Online Shopping Portal Project Parameter cancelorder.php sql injection](https://agentprime.io/advisories/CVE-2026-5636.md)
  `CVE-2026-5636` · CVE record: PHPGurukul Online Shopping Portal Project · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection
- [PHPGurukul Online Shopping Portal Project Parameter categorywise-products.php sql injection](https://agentprime.io/advisories/CVE-2026-5635.md)
  `CVE-2026-5635` · CVE record: PHPGurukul Online Shopping Portal Project · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection
- [projectworlds Car Rental Project Parameter book_car.php sql injection](https://agentprime.io/advisories/CVE-2026-5634.md)
  `CVE-2026-5634` · CVE record: projectworlds Car Rental Project · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, SQL injection

Newest: <https://agentprime.io/advisories/tag/sql-injection.md>
Older: <https://agentprime.io/advisories/tag/sql-injection.md?cursor=WyIyMDI2LTA0LTA2VDA3OjMwOjExLjkwNjAwMFoiLCJDVkUtMjAyNi01NjM0Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=sql-injection&cursor=WyIyMDI2LTA0LTA5VDAwOjQ1OjEwLjgxODAwMFoiLCJDVkUtMjAyNi01ODI3Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/sql-injection/?cursor=WyIyMDI2LTA0LTA5VDAwOjQ1OjEwLjgxODAwMFoiLCJDVkUtMjAyNi01ODI3Il0>. Everything for agents: <https://agentprime.io/llms.txt>.