# SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module.](https://agentprime.io/advisories/CVE-2025-50229.md)
  `CVE-2025-50229` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Apr 2026 · Tags: SQL injection
- [SQL injection in Rocket.Chat](https://agentprime.io/advisories/CVE-2026-29198.md)
  `CVE-2026-29198` · CVE record: Rocket.Chat Rocket.Chat · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Apr 2026 · Tags: SQL injection
- [pgx: SQL Injection via placeholder confusion with dollar quoted string literals](https://agentprime.io/advisories/GHSA-j88v-2chj-qfwx.md)
  `GHSA-j88v-2chj-qfwx`, `CVE-2026-41889`, `GO-2026-5004` · Go `github.com/jackc/pgx` and 2 more: affected `<=3.6.2`, no fixed version yet · CVSS 2.3 Low · Not analysed yet · Published 22 Apr 2026 · Tags: SQL injection
- [Jellystat has SQL Injection that leads to to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-41167.md)
  `CVE-2026-41167` · CVE record: CyferShepard Jellystat · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Apr 2026 · Tags: SQL injection
- [@nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading](https://agentprime.io/advisories/GHSA-4948-f92q-f432.md)
  `GHSA-4948-f92q-f432`, `CVE-2026-41640` · npm `@nocobase/database`: affected `<2.0.39`, fixed in `2.0.39` · CVSS 7.5 High · Not analysed yet · Published 22 Apr 2026 · Tags: SQL injection
- [@nocobase/plugin-collection-sql: SQL Validation Bypass Through Missing \`checkSQL\` Call](https://agentprime.io/advisories/GHSA-wrwh-c28m-9jjh.md)
  `GHSA-wrwh-c28m-9jjh`, `CVE-2026-41641` · npm `@nocobase/plugin-collection-sql`: affected `<2.0.39`, fixed in `2.0.39` · CVSS 7.2 High · Not analysed yet · Published 22 Apr 2026 · Tags: SQL injection, Broken access control
- [Daptin: SQL injection via unvalidated goqu.L() calls in aggregate API](https://agentprime.io/advisories/GHSA-rw2c-8rfq-gwfv.md)
  `GHSA-rw2c-8rfq-gwfv`, `CVE-2026-41422`, `GO-2026-5640` · Go `github.com/daptin/daptin`: affected `<0.11.4`, fixed in `0.11.4` · CVSS 8.3 High · Not analysed yet · Published 22 Apr 2026 · Tags: SQL injection
- [aEnrich｜a+HRD - SQL Injection](https://agentprime.io/advisories/CVE-2026-6833.md)
  `CVE-2026-6833` · CVE record: aEnrich a+HRD · CVSS 7.1 High · Not analysed yet · Published 22 Apr 2026 · Tags: SQL injection
- [OwnTone Server < 29.1 SQL Injection via query and filter Parameters](https://agentprime.io/advisories/CVE-2026-41457.md)
  `CVE-2026-41457` · CVE record: owntone owntone-server · CVSS 6.9 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: SQL injection
- [Electric: SQL Injection via ORDER BY Parameter in Shape API](https://agentprime.io/advisories/CVE-2026-40906.md)
  `CVE-2026-40906` · CVE record: electric-sql electric · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Apr 2026 · Tags: SQL injection
- [Frappe HR has possibility of SQL Injection due to improper field sanitization](https://agentprime.io/advisories/CVE-2026-41320.md)
  `CVE-2026-41320` · CVE record: frappe hrms · CVSS 6.5 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: SQL injection
- [mailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API](https://agentprime.io/advisories/CVE-2026-40871.md)
  `CVE-2026-40871` · CVE record: mailcow mailcow-dockerized · CVSS 7.2 High · Not analysed yet · Published 21 Apr 2026 · Tags: SQL injection, CWE-20, CWE-116
- [OpenBao's SQL Injection in PostgreSQL database secrets engine](https://agentprime.io/advisories/GHSA-6vgr-cp5c-ffx3.md)
  `GHSA-6vgr-cp5c-ffx3`, `BIT-openbao-2026-39946`, `CVE-2026-39946`, `GO-2026-5192` · Go `github.com/openbao/openbao`: affected `<0.0.0-20260420155735-b596b0882620`, fixed in `0.0.0-20260420155735-b596b0882620` · CVSS 4.6 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: SQL injection
- [Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values](https://agentprime.io/advisories/GHSA-grp3-h8m8-45p7.md)
  `GHSA-grp3-h8m8-45p7`, `CVE-2026-35588`, `PYSEC-2026-2177` · PyPI `glances`: affected `<4.5.4`, fixed in `4.5.4` · CVSS 6.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: SQL injection
- [SQL injection in Zeon Academy Pro by Zeon Global Tech](https://agentprime.io/advisories/CVE-2025-41029.md)
  `CVE-2025-41029` · CVE record: Zeon Global Tech Zeon Academy Pro · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Apr 2026 · Tags: SQL injection
- [Plugin: CMS für Motorrad Werkstätten <= 1.0.0 - Authenticated (Subscriber+) SQL Injection via 'arttype' Parameter](https://agentprime.io/advisories/CVE-2026-6674.md)
  `CVE-2026-6674` · CVE record: tholstkabelbwde Plugin: CMS für Motorrad Werkstätten · CVSS 6.5 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: SQL injection
- [Apache Doris MCP Server vulnerable to SQL Injection via improper query context neutralization](https://agentprime.io/advisories/GHSA-qhfq-gvvc-5q6q.md)
  `GHSA-qhfq-gvvc-5q6q`, `CVE-2025-66335`, `PYSEC-2026-2459` · PyPI `doris-mcp-server`: affected `>=0.1.0, <0.6.1`, fixed in `0.6.1` · CVSS 5.3 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: SQL injection
- [Metasoft 美特软件 MetaCRM Interface sql.jsp Statement.executeUpdate sql injection](https://agentprime.io/advisories/CVE-2026-6629.md)
  `CVE-2026-6629` · CVE record: Metasoft 美特软件 MetaCRM · CVSS 6.9 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Other injection, SQL injection
- [phili67 Ecclesia CRM Query Viewer view ValidateInput sql injection](https://agentprime.io/advisories/CVE-2026-6628.md)
  `CVE-2026-6628` · CVE record: phili67 Ecclesia CRM · CVSS 5.3 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Other injection, SQL injection
- [Digiwin｜EasyFlow .NET - SQL Injection](https://agentprime.io/advisories/CVE-2026-5964.md)
  `CVE-2026-5964` · CVE record: Digiwin EasyFlow .NET · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Apr 2026 · Tags: SQL injection
- [Digiwin｜EasyFlow .NET - SQL Injection](https://agentprime.io/advisories/CVE-2026-5963.md)
  `CVE-2026-5963` · CVE record: Digiwin EasyFlow .NET · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Apr 2026 · Tags: SQL injection
- [ProjectsAndPrograms School Management System HTTP GET Parameter buslocation.php sql injection](https://agentprime.io/advisories/CVE-2026-6595.md)
  `CVE-2026-6595` · CVE record: ProjectsAndPrograms School Management System · CVSS 6.9 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Other injection, SQL injection
- [SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the email parameter of the forgot password page (forgot-password.php).](https://agentprime.io/advisories/CVE-2026-39111.md)
  `CVE-2026-39111` · CVE record · CVSS 7.5 High · Not analysed yet · Published 20 Apr 2026 · Tags: SQL injection
- [SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the contactno parameter of the forgot password page (forgot-password.php).](https://agentprime.io/advisories/CVE-2026-39110.md)
  `CVE-2026-39110` · CVE record · CVSS 8.2 High · Not analysed yet · Published 20 Apr 2026 · Tags: SQL injection
- [SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 within the username parameter of the login page (index.php).](https://agentprime.io/advisories/CVE-2026-39109.md)
  `CVE-2026-39109` · CVE record · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Apr 2026 · Tags: SQL injection
- [dameng100 muucmf index.html getListByPage sql injection](https://agentprime.io/advisories/CVE-2026-6562.md)
  `CVE-2026-6562` · CVE record: dameng100 muucmf · CVSS 6.9 Medium · Not analysed yet · Published 19 Apr 2026 · Tags: Other injection, SQL injection
- [Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations](https://agentprime.io/advisories/GHSA-mjw2-v2hm-wj34.md)
  `GHSA-mjw2-v2hm-wj34`, `CVE-2026-41490`, `PYSEC-2026-2432`, `PYSEC-2026-2433`, `PYSEC-2026-2434`, `PYSEC-2026-2435`, `PYSEC-2026-2436`, `PYSEC-2026-2437` · PyPI `dagster` and 5 more: affected `<1.13.1`, fixed in `1.13.1` · CVSS 8.3 High · Not analysed yet · Published 18 Apr 2026 · Tags: SQL injection
- [YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()](https://agentprime.io/advisories/GHSA-f58v-p6j9-24c2.md)
  `GHSA-f58v-p6j9-24c2`, `CVE-2026-41143`, `PKSA-n7s9-fhkk-29wv` · Packagist `yeswiki/yeswiki`: affected `<4.6.1`, fixed in `4.6.1` · CVSS 8.8 High · Not analysed yet · Published 18 Apr 2026 · Tags: SQL injection
- [ChurchCRM has Authenticated SQL Injection in \`/api/families/byCheckNumber/{scanString}\`](https://agentprime.io/advisories/CVE-2026-40482.md)
  `CVE-2026-40482` · CVE record: ChurchCRM CRM · CVSS 7.1 High · Not analysed yet · Published 17 Apr 2026 · Tags: SQL injection
- [PraisonAI: SQL Injection via unvalidated \`table_prefix\` in 9 conversation store backends (incomplete fix for CVE-2026-40315)](https://agentprime.io/advisories/GHSA-rg3h-x3jw-7jm5.md)
  `GHSA-rg3h-x3jw-7jm5`, `CVE-2026-41496`, `PYSEC-2026-2923`, `PYSEC-2026-2952` · PyPI `praisonai` and 1 more: affected `<4.5.149`, fixed in `4.5.149` · CVSS 8.1 High · Not analysed yet · Published 17 Apr 2026 · Tags: SQL injection
- [WeGIA has SQL Injection via Session Variable Override in DespachoControle.php](https://agentprime.io/advisories/CVE-2026-40285.md)
  `CVE-2026-40285` · CVE record: LabRedesCefetRJ WeGIA · CVSS 8.8 High · Not analysed yet · Published 17 Apr 2026 · Tags: SQL injection, CWE-302, CWE-473
- [QueryMine sms GET Request Parameter deletecourse.php sql injection](https://agentprime.io/advisories/CVE-2026-6490.md)
  `CVE-2026-6490` · CVE record: QueryMine sms · CVSS 6.9 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Other injection, SQL injection
- [QueryMine sms GET Request Parameter editcourse.php sql injection](https://agentprime.io/advisories/CVE-2026-6488.md)
  `CVE-2026-6488` · CVE record: QueryMine sms · CVSS 5.3 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Other injection, SQL injection
- [Unauthenticated execution of arbitrary SQL queries in Sparx Pro Cloud Server](https://agentprime.io/advisories/CVE-2025-15625.md)
  `CVE-2025-15625` · CVE record: Sparx Systems Pty Ltd. Sparx Pro Cloud Server · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Apr 2026 · Tags: SQL injection, Information disclosure
- [SQL injection in CubeCart](https://agentprime.io/advisories/CVE-2026-34018.md)
  `CVE-2026-34018` · CVE record: CubeCart Limited CubeCart · CVSS 5.1 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: SQL injection
- [Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter](https://agentprime.io/advisories/CVE-2026-6080.md)
  `CVE-2026-6080` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 6.5 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: SQL injection
- [Form Maker by 10Web <= 1.15.40 - Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter](https://agentprime.io/advisories/CVE-2026-3330.md)
  `CVE-2026-3330` · CVE record: 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder · CVSS 4.9 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: SQL injection
- [MasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters](https://agentprime.io/advisories/CVE-2026-4817.md)
  `CVE-2026-4817` · CVE record: stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education · CVSS 6.5 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: SQL injection
- [A SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows remote unauthenticated attackers to bypass authentication via the username parameter in index.php.](https://agentprime.io/advisories/CVE-2026-37749.md)
  `CVE-2026-37749` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Apr 2026 · Tags: SQL injection
- [Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)](https://agentprime.io/advisories/GHSA-jp74-mfrx-3qvh.md)
  `GHSA-jp74-mfrx-3qvh`, `CVE-2026-41478` · npm `@saltcorn/server`: affected `<1.4.6 || >=1.5.0-beta.0, <1.5.6 || >=1.6.0-alpha.0, <1.6.0-beta.5`, fixed in `1.4.6`, `1.5.6`, `1.6.0-beta.5` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [DataEase has SQL Injection via Stacked Queries](https://agentprime.io/advisories/CVE-2026-40900.md)
  `CVE-2026-40900` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [DataEase SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-33207.md)
  `CVE-2026-33207` · CVE record: dataease dataease · CVSS 8.6 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [DataEase has SQL Injection via Datasource Management](https://agentprime.io/advisories/CVE-2026-33122.md)
  `CVE-2026-33122` · CVE record: dataease dataease · CVSS 8.6 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [DataEase has SQL Injection via Datasource Save Flow](https://agentprime.io/advisories/CVE-2026-33121.md)
  `CVE-2026-33121` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [DataEase has SQL Injection through its getFieldEnumObj Endpoint](https://agentprime.io/advisories/CVE-2026-33084.md)
  `CVE-2026-33084` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [DataEase has SQL Injection in Order By Clause](https://agentprime.io/advisories/CVE-2026-33083.md)
  `CVE-2026-33083` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [DataEase: SQL Injection in v2 Dataset Export](https://agentprime.io/advisories/CVE-2026-33082.md)
  `CVE-2026-33082` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [SQL Injection](https://agentprime.io/advisories/CVE-2026-5785.md)
  `CVE-2026-5785` · CVE record: Zohocorp ManageEngine PAM360 and 1 more · CVSS 8.1 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.26 - Unauthenticated SQL Injection via 'packages'](https://agentprime.io/advisories/CVE-2026-3489.md)
  `CVE-2026-3489` · CVE record: designinvento DirectoryPress – Business Directory And Classified Ad Listing · CVSS 7.5 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [Accessibility Suite by Ability, Inc <= 4.20 - Authenticated (Subscriber+) SQL Injection via 'scan_id' Parameter](https://agentprime.io/advisories/CVE-2026-3773.md)
  `CVE-2026-3773` · CVE record: onlineada Accessibility Suite by Ability, Inc · CVSS 6.5 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [Riaxe Product Customizer <= 2.1.2 - Unauthenticated SQL Injection via 'options' Parameter Keys in product_data](https://agentprime.io/advisories/CVE-2026-3599.md)
  `CVE-2026-3599` · CVE record: imprintnext Riaxe Product Customizer · CVSS 7.5 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_employee.php.](https://agentprime.io/advisories/CVE-2026-37347.md)
  `CVE-2026-37347` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_account.php?emp_id=.](https://agentprime.io/advisories/CVE-2026-37346.md)
  `CVE-2026-37346` · CVE record · CVSS 4.7 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_park.php.](https://agentprime.io/advisories/CVE-2026-37345.md)
  `CVE-2026-37345` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_location.php.](https://agentprime.io/advisories/CVE-2026-37344.md)
  `CVE-2026-37344` · CVE record · CVSS 7.2 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_user.php.](https://agentprime.io/advisories/CVE-2026-37343.md)
  `CVE-2026-37343` · CVE record · CVSS 7.2 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/view_parked_details.php.](https://agentprime.io/advisories/CVE-2026-37342.md)
  `CVE-2026-37342` · CVE record · CVSS 7.2 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_category.php.](https://agentprime.io/advisories/CVE-2026-37341.md)
  `CVE-2026-37341` · CVE record · CVSS 7.2 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/edit_music.php.](https://agentprime.io/advisories/CVE-2026-37340.md)
  `CVE-2026-37340` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_genre.php.](https://agentprime.io/advisories/CVE-2026-37339.md)
  `CVE-2026-37339` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection

Newest: <https://agentprime.io/advisories/tag/sql-injection.md>
Older: <https://agentprime.io/advisories/tag/sql-injection.md?cursor=WyIyMDI2LTA0LTE2VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNi0zNzMzOSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=sql-injection&cursor=WyIyMDI2LTA0LTIzVDA0OjE1OjMzLjQxNDAwMFoiLCJDVkUtMjAyNi00MDUyOSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/sql-injection/?cursor=WyIyMDI2LTA0LTIzVDA0OjE1OjMzLjQxNDAwMFoiLCJDVkUtMjAyNi00MDUyOSJd>. Everything for agents: <https://agentprime.io/llms.txt>.