# SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [tushar-2223 Hotel Management System roomdelete.php sql injection](https://agentprime.io/advisories/CVE-2026-6142.md)
  `CVE-2026-6142` · CVE record: tushar-2223 Hotel Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Other injection, SQL injection
- [Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in the file /otas/admin/curriculum/manage_curriculum.php.](https://agentprime.io/advisories/CVE-2026-36952.md)
  `CVE-2026-36952` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in /otas/projects_per_department.php.](https://agentprime.io/advisories/CVE-2026-36950.md)
  `CVE-2026-36950` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [Sourcecodester Online Thesis Archiving System v1.0 is vulnerale to SQL injection in the file /otas/view_archive.php.](https://agentprime.io/advisories/CVE-2026-36948.md)
  `CVE-2026-36948` · CVE record · CVSS 7.3 High · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL Injection in the file /rsms/admin/services/view_service.php.](https://agentprime.io/advisories/CVE-2026-36947.md)
  `CVE-2026-36947` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/inquiries/view_details.php.](https://agentprime.io/advisories/CVE-2026-36946.md)
  `CVE-2026-36946` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/clients/manage_client.php](https://agentprime.io/advisories/CVE-2026-36945.md)
  `CVE-2026-36945` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerale to SQL injection in the file/rsms/admin/repairs/view_details.php.](https://agentprime.io/advisories/CVE-2026-36944.md)
  `CVE-2026-36944` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/repairs/manage_repair.php.](https://agentprime.io/advisories/CVE-2026-36943.md)
  `CVE-2026-36943` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in the file /orms/admin/activities/manage_activity.php.](https://agentprime.io/advisories/CVE-2026-36942.md)
  `CVE-2026-36942` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL Injection in the file /orms/admin/rooms/manage_room.php.](https://agentprime.io/advisories/CVE-2026-36941.md)
  `CVE-2026-36941` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/rooms/view_room.php.](https://agentprime.io/advisories/CVE-2026-36938.md)
  `CVE-2026-36938` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/reservations/view_details.php.](https://agentprime.io/advisories/CVE-2026-36937.md)
  `CVE-2026-36937` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [Sourcecodester Cab Management System 1.0 is vulnerable to SQL Injection in the file /cms/admin/bookings/view_booking.php.](https://agentprime.io/advisories/CVE-2026-36923.md)
  `CVE-2026-36923` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [Sourcecodester Cab Management System v1.0 is vulnerable to SQL injection in the file /cms/admin/categories/view_category.php.](https://agentprime.io/advisories/CVE-2026-36922.md)
  `CVE-2026-36922` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [Sourcecodester Online Reviewer System v1.0 is vulnerable to SQL Injection in the file /system/system/admins/assessments/examproper/questions-view.php.](https://agentprime.io/advisories/CVE-2026-36920.md)
  `CVE-2026-36920` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [Sourcecodester Online Reviewer System v1.0 is vulnerale to SQL Injection in the file /system/system/admins/assessments/examproper/exam-update.php.](https://agentprime.io/advisories/CVE-2026-36919.md)
  `CVE-2026-36919` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_student.php.](https://agentprime.io/advisories/CVE-2026-36874.md)
  `CVE-2026-36874` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_admin.php.](https://agentprime.io/advisories/CVE-2026-36873.md)
  `CVE-2026-36873` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_book.php.](https://agentprime.io/advisories/CVE-2026-36872.md)
  `CVE-2026-36872` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 13 Apr 2026 · Tags: SQL injection
- [Dolibarr has SQL injection vulnerability in the rowid parameter of the admin dict.php](https://agentprime.io/advisories/GHSA-xxxg-x793-7fq3.md)
  `GHSA-xxxg-x793-7fq3`, `CVE-2019-25710`, `PKSA-5yjp-cmsh-j9sp` · Packagist `dolibarr/dolibarr`: affected `<=8.0.4`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 12 Apr 2026 · Tags: SQL injection
- [MyT-PM 1.5.1 SQL Injection via Charge\[group_total\] Parameter](https://agentprime.io/advisories/CVE-2019-25713.md)
  `CVE-2019-25713` · CVE record: MyT Project Management · CVSS 7.1 High · Not analysed yet · Published 12 Apr 2026 · Tags: SQL injection
- [eBrigade ERP 4.5 SQL Injection via pdf.php](https://agentprime.io/advisories/CVE-2019-25707.md)
  `CVE-2019-25707` · CVE record: Ebrigade eBrigade ERP · CVSS 7.1 High · Not analysed yet · Published 12 Apr 2026 · Tags: SQL injection
- [ImpressCMS 1.3.11 SQL Injection via bid Parameter](https://agentprime.io/advisories/CVE-2019-25703.md)
  `CVE-2019-25703` · CVE record: Impresscms ImpressCMS · CVSS 7.1 High · Not analysed yet · Published 12 Apr 2026 · Tags: SQL injection
- [Newsbull Haber Script 1.0.0 Authenticated SQL Injection via search parameter](https://agentprime.io/advisories/CVE-2019-25699.md)
  `CVE-2019-25699` · CVE record: Newsbull Newsbull Haber Script · CVSS 7.1 High · Not analysed yet · Published 12 Apr 2026 · Tags: SQL injection
- [CMSsite 1.0 SQL Injection via category.php](https://agentprime.io/advisories/CVE-2019-25697.md)
  `CVE-2019-25697` · CVE record: VictorAlagwu CMSsite · CVSS 8.8 High · Not analysed yet · Published 12 Apr 2026 · Tags: SQL injection
- [Adianti Framework 5.5.0 and 5.6.0 SQL Injection via Profile](https://agentprime.io/advisories/CVE-2018-25257.md)
  `CVE-2018-25257` · CVE record: adianti Adianti Framework · CVSS 7.1 High · Not analysed yet · Published 12 Apr 2026 · Tags: SQL injection
- [LifterLMS <= 9.2.1 - Authenticated (Custom+) SQL Injection via 'order' Parameter](https://agentprime.io/advisories/CVE-2026-5207.md)
  `CVE-2026-5207` · CVE record: chrisbadgett LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes · CVSS 6.5 Medium · Not analysed yet · Published 11 Apr 2026 · Tags: SQL injection
- [PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries](https://agentprime.io/advisories/GHSA-x783-xp3g-mqhp.md)
  `GHSA-x783-xp3g-mqhp`, `CVE-2026-40315`, `PYSEC-2026-2925` · PyPI `praisonai`: affected `<4.5.133`, fixed in `4.5.133` · CVSS 7.2 High · Not analysed yet · Published 10 Apr 2026 · Tags: SQL injection
- [@saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler](https://agentprime.io/advisories/GHSA-59xv-588h-2vmm.md)
  `GHSA-59xv-588h-2vmm` · npm `@saltcorn/data`: affected `<1.4.5 || >=1.5.0, <1.5.5 || >=1.6.0-alpha.0, <1.6.0-beta.4`, fixed in `1.4.5`, `1.5.5`, `1.6.0-beta.4` · CVSS 0.0 None · Not analysed yet · Published 10 Apr 2026 · Tags: SQL injection
- [code-projects Vehicle Showroom Management System RegisterCustomerFunction.php sql injection](https://agentprime.io/advisories/CVE-2026-6038.md)
  `CVE-2026-6038` · CVE record: code-projects Vehicle Showroom Management System · CVSS 6.9 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Vehicle Showroom Management System AddVehicleFunction.php sql injection](https://agentprime.io/advisories/CVE-2026-6037.md)
  `CVE-2026-6037` · CVE record: code-projects Vehicle Showroom Management System · CVSS 6.9 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Vehicle Showroom Management System VehicleDetailsFunction.php sql injection](https://agentprime.io/advisories/CVE-2026-6036.md)
  `CVE-2026-6036` · CVE record: code-projects Vehicle Showroom Management System · CVSS 6.9 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection
- [CodeAstro Online Classroom updatedetailsfromstudent.php sql injection](https://agentprime.io/advisories/CVE-2026-6033.md)
  `CVE-2026-6033` · CVE record: CodeAstro Online Classroom · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Simple IT Discussion Forum add-category-function.php sql injection](https://agentprime.io/advisories/CVE-2026-6031.md)
  `CVE-2026-6031` · CVE record: code-projects Simple IT Discussion Forum · CVSS 6.9 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection
- [itsourcecode Construction Management System del1.php sql injection](https://agentprime.io/advisories/CVE-2026-6030.md)
  `CVE-2026-6030` · CVE record: itsourcecode Construction Management System · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection
- [CodeAstro Online Classroom takeassessment2.php sql injection](https://agentprime.io/advisories/CVE-2026-6010.md)
  `CVE-2026-6010` · CVE record: CodeAstro Online Classroom · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection
- [itsourcecode Construction Management System del.php sql injection](https://agentprime.io/advisories/CVE-2026-6007.md)
  `CVE-2026-6007` · CVE record: itsourcecode Construction Management System · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Patient Record Management System edit_hpatient.php sql injection](https://agentprime.io/advisories/CVE-2026-6006.md)
  `CVE-2026-6006` · CVE record: code-projects Patient Record Management System · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Patient Record Management System hematology_print.php sql injection](https://agentprime.io/advisories/CVE-2026-6005.md)
  `CVE-2026-6005` · CVE record: code-projects Patient Record Management System · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Simple IT Discussion Forum delete-category.php sql injection](https://agentprime.io/advisories/CVE-2026-6004.md)
  `CVE-2026-6004` · CVE record: code-projects Simple IT Discussion Forum · CVSS 6.9 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, SQL injection
- [SourceCodester Engineers Online Portal v1.0 is vulnerable to SQL Injection in update_password.php via the new_password parameter.](https://agentprime.io/advisories/CVE-2026-36236.md)
  `CVE-2026-36236` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2026 · Tags: SQL injection
- [A SQL injection vulnerability was found in the scheduleSubList.php file of itsourcecode Online Student Enrollment System v1.0.](https://agentprime.io/advisories/CVE-2026-36235.md)
  `CVE-2026-36235` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2026 · Tags: SQL injection
- [itsourcecode Online Student Enrollment System v1.0 is vulnerable to SQL Injection in newCourse.php via the 'coursename' parameter.](https://agentprime.io/advisories/CVE-2026-36234.md)
  `CVE-2026-36234` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2026 · Tags: SQL injection
- [A SQL injection vulnerability was found in the assignInstructorSubjects.php file of itsourcecode Online Student Enrollment System v1.0.](https://agentprime.io/advisories/CVE-2026-36233.md)
  `CVE-2026-36233` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2026 · Tags: SQL injection
- [A SQL injection vulnerability was found in the instructorClasses.php file of itsourcecode Online Student Enrollment System v1.0.](https://agentprime.io/advisories/CVE-2026-36232.md)
  `CVE-2026-36232` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2026 · Tags: SQL injection
- [PHP-MYSQL-User-Login-System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at login.php.](https://agentprime.io/advisories/CVE-2026-29861.md)
  `CVE-2026-29861` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2026 · Tags: SQL injection
- [An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22.](https://agentprime.io/advisories/CVE-2026-23780.md)
  `CVE-2026-23780` · CVE record · CVSS 8.8 High · Not analysed yet · Published 10 Apr 2026 · Tags: SQL injection
- [code-projects Simple IT Discussion Forum crud.php sql injection](https://agentprime.io/advisories/CVE-2026-5985.md)
  `CVE-2026-5985` · CVE record: code-projects Simple IT Discussion Forum · CVSS 6.9 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, SQL injection
- [WordPress adivaha Travel Plugin 2.3 SQL Injection via pid](https://agentprime.io/advisories/CVE-2023-54359.md)
  `CVE-2023-54359` · CVE record: Adivaha WordPress adivaha Travel Plugin · CVSS 8.8 High · Not analysed yet · Published 9 Apr 2026 · Tags: SQL injection
- [code-projects Simple IT Discussion Forum topic-details.php sql injection](https://agentprime.io/advisories/CVE-2026-5961.md)
  `CVE-2026-5961` · CVE record: code-projects Simple IT Discussion Forum · CVSS 6.9 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, SQL injection
- [SQL injection in SonicWall SMA1000](https://agentprime.io/advisories/CVE-2026-4112.md)
  `CVE-2026-4112` · CVE record: SonicWall SMA1000 · CVSS 7.2 High · Not analysed yet · Published 9 Apr 2026 · Tags: SQL injection
- [SQL Injection in AlanWeb SCADA](https://agentprime.io/advisories/CVE-2026-34185.md)
  `CVE-2026-34185` · CVE record: Control System AlanWeb SCADA · CVSS 8.7 High · Not analysed yet · Published 9 Apr 2026 · Tags: SQL injection
- [PHPGurukul News Portal Project check_availability.php sql injection](https://agentprime.io/advisories/CVE-2026-5840.md)
  `CVE-2026-5840` · CVE record: PHPGurukul News Portal Project · CVSS 5.1 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, SQL injection
- [PHPGurukul News Portal Project add-subcategory.php sql injection](https://agentprime.io/advisories/CVE-2026-5839.md)
  `CVE-2026-5839` · CVE record: PHPGurukul News Portal Project · CVSS 5.1 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, SQL injection
- [PHPGurukul News Portal Project add-subadmins.php sql injection](https://agentprime.io/advisories/CVE-2026-5838.md)
  `CVE-2026-5838` · CVE record: PHPGurukul News Portal Project · CVSS 5.1 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, SQL injection
- [PHPGurukul News Portal Project news-details.php sql injection](https://agentprime.io/advisories/CVE-2026-5837.md)
  `CVE-2026-5837` · CVE record: PHPGurukul News Portal Project · CVSS 6.9 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Simple IT Discussion Forum content.php sql injection](https://agentprime.io/advisories/CVE-2026-5829.md)
  `CVE-2026-5829` · CVE record: code-projects Simple IT Discussion Forum · CVSS 6.9 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Simple IT Discussion Forum addcomment.php sql injection](https://agentprime.io/advisories/CVE-2026-5828.md)
  `CVE-2026-5828` · CVE record: code-projects Simple IT Discussion Forum · CVSS 6.9 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, SQL injection
- [code-projects Simple IT Discussion Forum question-function.php sql injection](https://agentprime.io/advisories/CVE-2026-5827.md)
  `CVE-2026-5827` · CVE record: code-projects Simple IT Discussion Forum · CVSS 6.9 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, SQL injection

Newest: <https://agentprime.io/advisories/tag/sql-injection.md>
Older: <https://agentprime.io/advisories/tag/sql-injection.md?cursor=WyIyMDI2LTA0LTA5VDAwOjQ1OjEwLjgxODAwMFoiLCJDVkUtMjAyNi01ODI3Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=sql-injection&cursor=WyIyMDI2LTA0LTEzVDAxOjMwOjE0Ljk3MDAwMFoiLCJDVkUtMjAyNi02MTQ4Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/sql-injection/?cursor=WyIyMDI2LTA0LTEzVDAxOjMwOjE0Ljk3MDAwMFoiLCJDVkUtMjAyNi02MTQ4Il0>. Everything for agents: <https://agentprime.io/llms.txt>.