# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [SourceCodester Pharmacy Sales and Inventory System ajax.php save_expired sql injection](https://agentprime.io/advisories/CVE-2026-7283.md) `CVE-2026-7283` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 5.1 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Other injection, SQL injection - [SourceCodester Pharmacy Sales and Inventory System ajax.php delete_expired sql injection](https://agentprime.io/advisories/CVE-2026-7282.md) `CVE-2026-7282` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 5.1 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Other injection, SQL injection - [SourceCodester Pizzafy Ecommerce System ajax.php save_category sql injection](https://agentprime.io/advisories/CVE-2026-7268.md) `CVE-2026-7268` · CVE record: SourceCodester Pizzafy Ecommerce System · CVSS 5.3 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Other injection, SQL injection - [SourceCodester Pizzafy Ecommerce System view_prod.php sql injection](https://agentprime.io/advisories/CVE-2026-7267.md) `CVE-2026-7267` · CVE record: SourceCodester Pizzafy Ecommerce System · CVSS 5.3 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Other injection, SQL injection - [SourceCodester Pizzafy Ecommerce System ajax.php save_order sql injection](https://agentprime.io/advisories/CVE-2026-7266.md) `CVE-2026-7266` · CVE record: SourceCodester Pizzafy Ecommerce System · CVSS 5.3 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Other injection, SQL injection - [SourceCodester Pizzafy Ecommerce System index.php category sql injection](https://agentprime.io/advisories/CVE-2026-7265.md) `CVE-2026-7265` · CVE record: SourceCodester Pizzafy Ecommerce System · CVSS 5.3 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Other injection, SQL injection - [Spring AI has SQL Injection in CosmosDBVectorStore.doDelete()](https://agentprime.io/advisories/GHSA-63c8-m9m2-cvr3.md) `GHSA-63c8-m9m2-cvr3`, `CVE-2026-40978` · Maven `org.springframework.ai:spring-ai-azure-cosmos-db-store`: affected `>=1.0.0, <1.0.6 || >=1.1.0, <1.1.5`, fixed in `1.0.6`, `1.1.5` · CVSS 8.8 High · Not analysed yet · Published 28 Apr 2026 · Tags: SQL injection - [SourceCodester Pizzafy Ecommerce System ajax.php get_cart_items sql injection](https://agentprime.io/advisories/CVE-2026-7264.md) `CVE-2026-7264` · CVE record: SourceCodester Pizzafy Ecommerce System · CVSS 5.3 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Coaching Management System POST reply.php sql injection](https://agentprime.io/advisories/CVE-2026-7229.md) `CVE-2026-7229` · CVE record: code-projects Coaching Management System · CVSS 5.3 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Other injection, SQL injection - [SourceCodester Pizzafy Ecommerce System ajax.php get_cart_count sql injection](https://agentprime.io/advisories/CVE-2026-7228.md) `CVE-2026-7228` · CVE record: SourceCodester Pizzafy Ecommerce System · CVSS 6.9 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Other injection, SQL injection - [SourceCodester Pizzafy Ecommerce System ajax.php login sql injection](https://agentprime.io/advisories/CVE-2026-7227.md) `CVE-2026-7227` · CVE record: SourceCodester Pizzafy Ecommerce System · CVSS 6.9 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Other injection, SQL injection - [SourceCodester Pizzafy Ecommerce System ajax.php login2 sql injection](https://agentprime.io/advisories/CVE-2026-7226.md) `CVE-2026-7226` · CVE record: SourceCodester Pizzafy Ecommerce System · CVSS 6.9 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Other injection, SQL injection - [SourceCodester Pizzafy Ecommerce System ajax.php delete_menu sql injection](https://agentprime.io/advisories/CVE-2026-7225.md) `CVE-2026-7225` · CVE record: SourceCodester Pizzafy Ecommerce System · CVSS 6.9 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Other injection, SQL injection - [SourceCodester Pizzafy Ecommerce System ajax.php delete_cart sql injection](https://agentprime.io/advisories/CVE-2026-7224.md) `CVE-2026-7224` · CVE record: SourceCodester Pizzafy Ecommerce System · CVSS 6.9 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Other injection, SQL injection - [sqlite-mcp has an Injection issue](https://agentprime.io/advisories/GHSA-4j28-22qp-rjcf.md) `GHSA-4j28-22qp-rjcf`, `CVE-2026-7206`, `PYSEC-2026-3074` · PyPI `sqlite-mcp`: affected `<=0.1.0`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Other injection, SQL injection - [SQL injection in ProFTPD](https://agentprime.io/advisories/CVE-2026-42167.md) `CVE-2026-42167` · CVE record: ProFTPD ProFTPD · CVSS 8.1 High · Not analysed yet · Published 28 Apr 2026 · Tags: SQL injection - [SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection](https://agentprime.io/advisories/CVE-2026-7199.md) `CVE-2026-7199` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [CodeAstro Online Classroom guestdetails sql injection](https://agentprime.io/advisories/CVE-2026-7196.md) `CVE-2026-7196` · CVE record: CodeAstro Online Classroom · CVSS 5.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection](https://agentprime.io/advisories/CVE-2026-7194.md) `CVE-2026-7194` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [Duplicate Advisory: Pimcore admin users can trigger SQL Injection](https://agentprime.io/advisories/GHSA-c8g3-x47w-8q7p.md) `GHSA-c8g3-x47w-8q7p` · Packagist `pimcore/pimcore`: affected `=12.3.3`, no fixed version yet · CVSS 4.0, no score published · Withdrawn · Not analysed yet · Published 27 Apr 2026 · Tags: SQL injection - [CodeAstro Online Classroom addnewfaculty sql injection](https://agentprime.io/advisories/CVE-2026-7148.md) `CVE-2026-7148` · CVE record: CodeAstro Online Classroom · CVSS 5.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [1000 Projects Portfolio Management System MCA block_status.php sql injection](https://agentprime.io/advisories/CVE-2026-7143.md) `CVE-2026-7143` · CVE record: 1000 Projects Portfolio Management System MCA · CVSS 5.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [ProjeQtor < 12.4.4 Unauthenticated SQL Injection via Login](https://agentprime.io/advisories/CVE-2026-41462.md) `CVE-2026-41462` · CVE record: ProjeQtor ProjeQtor · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: SQL injection - [code-projects Online Lot Reservation System loginuser.php sql injection](https://agentprime.io/advisories/CVE-2026-7131.md) `CVE-2026-7131` · CVE record: code-projects Online Lot Reservation System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection](https://agentprime.io/advisories/CVE-2026-7130.md) `CVE-2026-7130` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection](https://agentprime.io/advisories/CVE-2026-7128.md) `CVE-2026-7128` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection](https://agentprime.io/advisories/CVE-2026-7127.md) `CVE-2026-7127` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection](https://agentprime.io/advisories/CVE-2026-7126.md) `CVE-2026-7126` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Employee Management System cancel.php sql injection](https://agentprime.io/advisories/CVE-2026-7118.md) `CVE-2026-7118` · CVE record: code-projects Employee Management System · CVSS 5.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Employee Management System approve.php sql injection](https://agentprime.io/advisories/CVE-2026-7117.md) `CVE-2026-7117` · CVE record: code-projects Employee Management System · CVSS 5.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Employee Management System delete.php sql injection](https://agentprime.io/advisories/CVE-2026-7115.md) `CVE-2026-7115` · CVE record: code-projects Employee Management System · CVSS 5.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [WordPress Directorist Booking plugin < 3.0.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-22336.md) `CVE-2026-22336` · CVE record: Directorist Booking Directorist Booking · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: SQL injection - [code-projects Employee Management System edit.php sql injection](https://agentprime.io/advisories/CVE-2026-7114.md) `CVE-2026-7114` · CVE record: code-projects Employee Management System · CVSS 5.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection](https://agentprime.io/advisories/CVE-2026-7088.md) `CVE-2026-7088` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection](https://agentprime.io/advisories/CVE-2026-7087.md) `CVE-2026-7087` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [likeadmin-likeshop likeadmin_php dataTable Admin API DataTableLists.php queryResult sql injection](https://agentprime.io/advisories/CVE-2026-7083.md) `CVE-2026-7083` · CVE record: likeadmin-likeshop likeadmin_php · CVSS 5.1 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [itsourcecode Courier Management System edit_parcel.php sql injection](https://agentprime.io/advisories/CVE-2026-7077.md) `CVE-2026-7077` · CVE record: itsourcecode Courier Management System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [itsourcecode Courier Management System edit_branch.php sql injection](https://agentprime.io/advisories/CVE-2026-7076.md) `CVE-2026-7076` · CVE record: itsourcecode Courier Management System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [itsourcecode Construction Management System locations.php sql injection](https://agentprime.io/advisories/CVE-2026-7075.md) `CVE-2026-7075` · CVE record: itsourcecode Construction Management System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [itsourcecode Construction Management System execute1.php sql injection](https://agentprime.io/advisories/CVE-2026-7074.md) `CVE-2026-7074` · CVE record: itsourcecode Construction Management System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [itsourcecode Construction Management System execute.php sql injection](https://agentprime.io/advisories/CVE-2026-7073.md) `CVE-2026-7073` · CVE record: itsourcecode Construction Management System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [CodePanda Source canteen_management_system login.php sql injection](https://agentprime.io/advisories/CVE-2026-7072.md) `CVE-2026-7072` · CVE record: CodePanda Source canteen_management_system · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Inventory Management System Login sql injection](https://agentprime.io/advisories/CVE-2026-7070.md) `CVE-2026-7070` · CVE record: code-projects Inventory Management System · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, SQL injection - [NASA Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to contain a SQL injection vulnerability in the category parameter](https://agentprime.io/advisories/CVE-2024-46636.md) `CVE-2024-46636` · CVE record · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: SQL injection - [SQL Injection vulnerability exists in Sourcecodester Online Job Portal phppdo 1.0 ivia the category parameter in /jobportal/index.php.](https://agentprime.io/advisories/CVE-2021-36438.md) `CVE-2021-36438` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: SQL injection - [code-projects Employee Management System Endpoint eprocess.php sql injection](https://agentprime.io/advisories/CVE-2026-7063.md) `CVE-2026-7063` · CVE record: code-projects Employee Management System · CVSS 6.9 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Other injection, SQL injection - [liyupi yu-picture MyBatis-Plus PictureServiceImpl.java PageRequest sql injection](https://agentprime.io/advisories/CVE-2026-7060.md) `CVE-2026-7060` · CVE record: liyupi yu-picture · CVSS 6.9 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Other injection, SQL injection - [CodeAstro Online Job Portal All Jobs delete-jobs.php sql injection](https://agentprime.io/advisories/CVE-2026-7028.md) `CVE-2026-7028` · CVE record: CodeAstro Online Job Portal · CVSS 5.1 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Other injection, SQL injection - [ByteDance coze-studio databaseTool database_impl.go ExecuteSQL sql injection](https://agentprime.io/advisories/CVE-2026-7023.md) `CVE-2026-7023` · CVE record: ByteDance coze-studio · CVSS 5.3 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Other injection, SQL injection - [KLiK SocialMediaWebsite Private Message get_message_ajax.php sql injection](https://agentprime.io/advisories/CVE-2026-7002.md) `CVE-2026-7002` · CVE record: KLiK SocialMediaWebsite · CVSS 6.9 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Other injection, SQL injection - [colinhacks Zod CUID Data Type regexes.ts sql injection](https://agentprime.io/advisories/CVE-2026-6991.md) `CVE-2026-6991` · CVE record: colinhacks Zod · CVSS 5.3 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Other injection, SQL injection - [ShowDoc has an Injection vulnerability](https://agentprime.io/advisories/GHSA-fm5r-cj7v-rj2c.md) `GHSA-fm5r-cj7v-rj2c`, `CVE-2026-6982`, `PKSA-r6d8-qs1d-pj19` · Packagist `showdoc/showdoc`: affected `<3.8.1`, fixed in `3.8.1` · CVSS 5.3 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Other injection, SQL injection - [JiZhiCMS addcache.html htmlspecialchars_decode sql injection](https://agentprime.io/advisories/CVE-2026-6978.md) `CVE-2026-6978` · CVE record: JiZhiCMS · CVSS 5.1 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Other injection, SQL injection - [LiteLLM has SQL Injection in Proxy API key verification](https://agentprime.io/advisories/GHSA-r75f-5x8p-qvmc.md) `GHSA-r75f-5x8p-qvmc`, `CVE-2026-42208`, `PYSEC-2026-391` · PyPI `litellm`: affected `>=1.81.16, <1.83.7`, fixed in `1.83.7` · CVSS 9.3 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.89 · Not analysed yet · Published 24 Apr 2026 · Tags: SQL injection - [Roxy-WI has SQL Injection in haproxy_section_save Endpoint via Unsanitized server_ip Parameter](https://agentprime.io/advisories/CVE-2026-33078.md) `CVE-2026-33078` · CVE record: roxy-wi roxy-wi · CVSS 8.9 High · Not analysed yet · Published 24 Apr 2026 · Tags: SQL injection - [Xibo CMS API has SQL Injection via DataSet Filter Parameter](https://agentprime.io/advisories/CVE-2026-31952.md) `CVE-2026-31952` · CVE record: xibosignage xibo-cms · CVSS 7.6 High · Not analysed yet · Published 24 Apr 2026 · Tags: SQL injection, CWE-184 - [OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database](https://agentprime.io/advisories/GHSA-v529-vhwc-wfc5.md) `GHSA-v529-vhwc-wfc5`, `CVE-2026-42087`, `PYSEC-2026-2244` · RubyGems `openc3`: affected `>=6.7.0, <7.0.0-rc3`, fixed in `7.0.0-rc3` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Apr 2026 · Tags: SQL injection - [SocialEngine <= 7.8.0 SQL Injection via activity/index/get-memberall](https://agentprime.io/advisories/CVE-2026-41460.md) `CVE-2026-41460` · CVE record: SocialEngine SocialEngine · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Apr 2026 · Tags: SQL injection - [BorG Technology Corporation｜Borg SPM 2007 - SQL Injection](https://agentprime.io/advisories/CVE-2026-6887.md) `CVE-2026-6887` · CVE record: BorG Technology Corporation Borg SPM 2007 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Apr 2026 · Tags: SQL injection - [SQL injection in KANATA Limited CMS ALAYA](https://agentprime.io/advisories/CVE-2026-40529.md) `CVE-2026-40529` · CVE record: KANATA Limited CMS ALAYA · CVSS 5.1 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .