# SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_user.php.](https://agentprime.io/advisories/CVE-2026-37338.md)
  `CVE-2026-37338` · CVE record · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_playlist.php.](https://agentprime.io/advisories/CVE-2026-37337.md)
  `CVE-2026-37337` · CVE record · CVSS 7.3 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_music.php.](https://agentprime.io/advisories/CVE-2026-37336.md)
  `CVE-2026-37336` · CVE record · CVSS 7.3 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [WordPress WCFM Marketplace plugin <= 3.7.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2025-63029.md)
  `CVE-2025-63029` · CVE record: WC Lovers WCFM Marketplace · CVSS 7.6 High · Not analysed yet · Published 15 Apr 2026 · Tags: SQL injection
- [Cisco Unity Connection SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-20061.md)
  `CVE-2026-20061` · CVE record: Cisco Cisco Unity Connection · CVSS 4.3 Medium · Not analysed yet · Published 15 Apr 2026 · Tags: SQL injection
- [WordPress Element Pack Elementor Addons plugin <= 8.4.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40745.md)
  `CVE-2026-40745` · CVE record: bdthemes Element Pack Elementor Addons · CVSS 7.6 High · Not analysed yet · Published 15 Apr 2026 · Tags: SQL injection
- [WordPress Beaver Builder plugin <= 2.10.1.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40744.md)
  `CVE-2026-40744` · CVE record: Beaver Builder Beaver Builder · CVSS 8.5 High · Not analysed yet · Published 15 Apr 2026 · Tags: SQL injection
- [Slah CMS v1.5.0 and below was discovered to contain a SQL injection vulnerability via the id parameter in the vereador_ver.php endpoint.](https://agentprime.io/advisories/CVE-2026-30995.md)
  `CVE-2026-30995` · CVE record · CVSS 8.6 High · Not analysed yet · Published 15 Apr 2026 · Tags: SQL injection
- [@vendure/core has a SQL Injection vulnerability](https://agentprime.io/advisories/GHSA-9pp3-53p2-ww9v.md)
  `GHSA-9pp3-53p2-ww9v`, `CVE-2026-40887` · npm `@vendure/core`: affected `>=1.7.4, <2.3.4 || >=3.0.0, <3.5.7 || >=3.6.0, <3.6.2`, fixed in `2.3.4`, `3.5.7`, `3.6.2` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [Chamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2)](https://agentprime.io/advisories/CVE-2026-33714.md)
  `CVE-2026-33714` · CVE record: chamilo chamilo-lms · CVSS 7.1 High · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [SQL Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-32176.md)
  `CVE-2026-32176` · CVE record: Microsoft Microsoft SQL Server 2016 Service Pack 3 (GDR) and 4 more · CVSS 6.7 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [SQL Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-32167.md)
  `CVE-2026-32167` · CVE record: Microsoft Microsoft SQL Server 2016 Service Pack 3 (GDR) and 4 more · CVSS 6.7 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [SQL injection in Fortinet FortiManager and others](https://agentprime.io/advisories/CVE-2025-61848.md)
  `CVE-2025-61848` · CVE record: Fortinet FortiManager and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [SQL injection in Fortinet FortiDDoS-F](https://agentprime.io/advisories/CVE-2026-39815.md)
  `CVE-2026-39815` · CVE record: Fortinet FortiDDoS-F · CVSS 7.9 High · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [SQL injection in Fortinet FortiClientEMS](https://agentprime.io/advisories/CVE-2026-39809.md)
  `CVE-2026-39809` · CVE record: Fortinet FortiClientEMS · CVSS 6.2 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '\_cct_search' Parameter](https://agentprime.io/advisories/CVE-2026-4352.md)
  `CVE-2026-4352` · CVE record: Crocoblock JetEngine · CVSS 7.5 High · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse](https://agentprime.io/advisories/CVE-2026-27681.md)
  `CVE-2026-27681` · CVE record: SAP_SE SAP Business Planning and Consolidation and SAP Business Warehouse · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget](https://agentprime.io/advisories/GHSA-875v-7m49-8x88.md)
  `GHSA-875v-7m49-8x88`, `CVE-2026-32271`, `PKSA-chpm-5f12-rdnt` · Packagist `craftcms/commerce`: affected `>=4.0.0, <4.10.3 || >=5.0.0, <5.5.5`, fixed in `4.10.3`, `5.5.5` · CVSS 7.7 High · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [Craft Commerce hasVariant/hasProduct Blind SQL Injection](https://agentprime.io/advisories/GHSA-r54v-qq87-px5r.md)
  `GHSA-r54v-qq87-px5r`, `CVE-2026-32272`, `PKSA-nhg1-858f-sgm2` · Packagist `craftcms/commerce`: affected `>=5.0.0, <5.6.0`, fixed in `5.6.0` · CVSS 8.7 High · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [Krayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rotten_lead parameter at /Lead/LeadDataGrid.php.](https://agentprime.io/advisories/CVE-2026-38528.md)
  `CVE-2026-38528` · CVE record · CVSS 7.1 High · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/user/manage_user.php.](https://agentprime.io/advisories/CVE-2026-37602.md)
  `CVE-2026-37602` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/manage_appointment.php.](https://agentprime.io/advisories/CVE-2026-37601.md)
  `CVE-2026-37601` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/view_details.php.](https://agentprime.io/advisories/CVE-2026-37600.md)
  `CVE-2026-37600` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to arbitrary code execution (RCE) via /scheduler/classes/SystemSettings.php?f=update_settings.](https://agentprime.io/advisories/CVE-2026-37598.md)
  `CVE-2026-37598` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/attendance_list.php.](https://agentprime.io/advisories/CVE-2026-37597.md)
  `CVE-2026-37597` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/manage_department.php.](https://agentprime.io/advisories/CVE-2026-37596.md)
  `CVE-2026-37596` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/manage_employee.php.](https://agentprime.io/advisories/CVE-2026-37595.md)
  `CVE-2026-37595` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/view_employee.php.](https://agentprime.io/advisories/CVE-2026-37594.md)
  `CVE-2026-37594` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/view_att.php.](https://agentprime.io/advisories/CVE-2026-37593.md)
  `CVE-2026-37593` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [Sourcecodester Storage Unit Rental Management System v1.0 is vulnerable to SQL in the file /storage/admin/maintenance/manage_pricing.php.](https://agentprime.io/advisories/CVE-2026-37592.md)
  `CVE-2026-37592` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [Sourcecodester Storage Unit Rental Management System v1.0 is vulnerable to SQL injection in the file /storage/admin/tenants/view_details.php.](https://agentprime.io/advisories/CVE-2026-37591.md)
  `CVE-2026-37591` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [SourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL Injection in the file /storage/admin/rents/manage_rent.php.](https://agentprime.io/advisories/CVE-2026-37590.md)
  `CVE-2026-37590` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [SourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL Injection in the file /storage/admin/maintenance/manage_storage_unit.php.](https://agentprime.io/advisories/CVE-2026-37589.md)
  `CVE-2026-37589` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [In manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability exists in /studentms/admin/between-date-reprtsdetails.php through the fromdate POST parameter.](https://agentprime.io/advisories/CVE-2025-65135.md)
  `CVE-2025-65135` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [A SQL injection vulnerability exists in the School Management System (version 1.0) by manikandan580.](https://agentprime.io/advisories/CVE-2025-65133.md)
  `CVE-2025-65133` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [Improper input handling in /Grocery/search_products_itname.php, in anirudhkannan Grocery Store Management System 1.0, allows SQL injection via the sitem_name POST parameter.](https://agentprime.io/advisories/CVE-2025-63939.md)
  `CVE-2025-63939` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [code-projects Easy Blog Site post.php sql injection](https://agentprime.io/advisories/CVE-2026-6202.md)
  `CVE-2026-6202` · CVE record: code-projects Easy Blog Site · CVSS 5.3 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection
- [PHPGurukul Daily Expense Tracking System register.php sql injection](https://agentprime.io/advisories/CVE-2026-6193.md)
  `CVE-2026-6193` · CVE record: PHPGurukul Daily Expense Tracking System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection
- [itsourcecode Construction Management System equipments.php sql injection](https://agentprime.io/advisories/CVE-2026-6191.md)
  `CVE-2026-6191` · CVE record: itsourcecode Construction Management System · CVSS 5.3 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection
- [itsourcecode Construction Management System employees.php sql injection](https://agentprime.io/advisories/CVE-2026-6190.md)
  `CVE-2026-6190` · CVE record: itsourcecode Construction Management System · CVSS 5.3 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection
- [SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection](https://agentprime.io/advisories/CVE-2026-6189.md)
  `CVE-2026-6189` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection
- [SQL Injection in Custom Fields leads to Database Compromise](https://agentprime.io/advisories/CVE-2026-34186.md)
  `CVE-2026-34186` · CVE record: Pandora FMS Pandora FMS · CVSS 8.7 High · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [SQL Injection in Module Search leads to Database Compromise](https://agentprime.io/advisories/CVE-2026-30813.md)
  `CVE-2026-30813` · CVE record: Pandora FMS Pandora FMS · CVSS 8.7 High · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection](https://agentprime.io/advisories/CVE-2026-6188.md)
  `CVE-2026-6188` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection
- [SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection](https://agentprime.io/advisories/CVE-2026-6187.md)
  `CVE-2026-6187` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Simple Content Management System index.php sql injection](https://agentprime.io/advisories/CVE-2026-6183.md)
  `CVE-2026-6183` · CVE record: code-projects Simple Content Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Simple Content Management System login.php sql injection](https://agentprime.io/advisories/CVE-2026-6182.md)
  `CVE-2026-6182` · CVE record: code-projects Simple Content Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Faculty Management System subject-print.php sql injection](https://agentprime.io/advisories/CVE-2026-6167.md)
  `CVE-2026-6167` · CVE record: code-projects Faculty Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Vehicle Showroom Management System UpdateVehicleFunction.php sql injection](https://agentprime.io/advisories/CVE-2026-6166.md)
  `CVE-2026-6166` · CVE record: code-projects Vehicle Showroom Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection
- [Product Filter for WooCommerce by WBW < 3.1.3 - Unauthenticated SQLi](https://agentprime.io/advisories/CVE-2026-3830.md)
  `CVE-2026-3830` · CVE record: Unknown Product Filter for WooCommerce by WBW · CVSS 8.6 High · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [Form Maker < 1.15.38 - SQL Injection](https://agentprime.io/advisories/CVE-2025-15441.md)
  `CVE-2025-15441` · CVE record: Unknown Form Maker by 10Web · CVSS 6.8 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [code-projects Vehicle Showroom Management System Login_check.php sql injection](https://agentprime.io/advisories/CVE-2026-6165.md)
  `CVE-2026-6165` · CVE record: code-projects Vehicle Showroom Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Lost and Found Thing Management addcat.php sql injection](https://agentprime.io/advisories/CVE-2026-6164.md)
  `CVE-2026-6164` · CVE record: code-projects Lost and Found Thing Management · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Lost and Found Thing Management catageory.php sql injection](https://agentprime.io/advisories/CVE-2026-6163.md)
  `CVE-2026-6163` · CVE record: code-projects Lost and Found Thing Management · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Simple ChatBox Endpoint insert.php sql injection](https://agentprime.io/advisories/CVE-2026-6161.md)
  `CVE-2026-6161` · CVE record: code-projects Simple ChatBox · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Vehicle Showroom Management System StaffDetailsFunction.php sql injection](https://agentprime.io/advisories/CVE-2026-6153.md)
  `CVE-2026-6153` · CVE record: code-projects Vehicle Showroom Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Vehicle Showroom Management System StaffAddingFunction.php sql injection](https://agentprime.io/advisories/CVE-2026-6152.md)
  `CVE-2026-6152` · CVE record: code-projects Vehicle Showroom Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Vehicle Showroom Management System PaymentStatusFunction.php sql injection](https://agentprime.io/advisories/CVE-2026-6151.md)
  `CVE-2026-6151` · CVE record: code-projects Vehicle Showroom Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Vehicle Showroom Management System BookVehicleFunction.php sql injection](https://agentprime.io/advisories/CVE-2026-6149.md)
  `CVE-2026-6149` · CVE record: code-projects Vehicle Showroom Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Vehicle Showroom Management System MonthTotalReportUpdateFunction.php sql injection](https://agentprime.io/advisories/CVE-2026-6148.md)
  `CVE-2026-6148` · CVE record: code-projects Vehicle Showroom Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection

Newest: <https://agentprime.io/advisories/tag/sql-injection.md>
Older: <https://agentprime.io/advisories/tag/sql-injection.md?cursor=WyIyMDI2LTA0LTEzVDAxOjMwOjE0Ljk3MDAwMFoiLCJDVkUtMjAyNi02MTQ4Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=sql-injection&cursor=WyIyMDI2LTA0LTE2VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNi0zNzMzOSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/sql-injection/?cursor=WyIyMDI2LTA0LTE2VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNi0zNzMzOSJd>. Everything for agents: <https://agentprime.io/llms.txt>.