# SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Dataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injection](https://agentprime.io/advisories/CVE-2026-8724.md)
  `CVE-2026-8724` · CVE record: Dataease · CVSS 5.1 Medium · Not analysed yet · Published 17 May 2026 · Tags: Other injection, SQL injection
- [Fuel CMS 1.4.13 Blind SQL Injection via col Parameter](https://agentprime.io/advisories/CVE-2021-47980.md)
  `CVE-2021-47980` · CVE record: Getfuelcms Fuel CMS · CVSS 7.1 High · Not analysed yet · Published 16 May 2026 · Tags: SQL injection
- [EgavilanMedia PHPCRUD 1.0 SQL Injection via firstname](https://agentprime.io/advisories/CVE-2021-47956.md)
  `CVE-2021-47956` · CVE record: Egavilanmedia EgavilanMedia PHPCRUD · CVSS 8.8 High · Not analysed yet · Published 16 May 2026 · Tags: SQL injection
- [LayerBB 1.1.4 SQL Injection via search_query Parameter](https://agentprime.io/advisories/CVE-2021-47954.md)
  `CVE-2021-47954` · CVE record: LayerBB LayerBB · CVSS 8.8 High · Not analysed yet · Published 16 May 2026 · Tags: SQL injection
- [WordPress Plugin Supsystic Membership 1.4.7 SQL Injection via sidx](https://agentprime.io/advisories/CVE-2020-37244.md)
  `CVE-2020-37244` · CVE record: Supsystic Membership · CVSS 8.8 High · Not analysed yet · Published 16 May 2026 · Tags: SQL injection
- [WordPress Plugin Supsystic Pricing Table 1.8.7 SQL Injection XSS](https://agentprime.io/advisories/CVE-2020-37243.md)
  `CVE-2020-37243` · CVE record: Supsystic Pricing Table · CVSS 8.8 High · Not analysed yet · Published 16 May 2026 · Tags: SQL injection
- [WordPress Plugin Supsystic Ultimate Maps 1.1.12 SQL Injection via sidx](https://agentprime.io/advisories/CVE-2020-37242.md)
  `CVE-2020-37242` · CVE record: Supsystic Ultimate Maps · CVSS 8.8 High · Not analysed yet · Published 16 May 2026 · Tags: SQL injection
- [Duplicate Advisory: phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields](https://agentprime.io/advisories/GHSA-p9wc-4pjv-rg82.md)
  `GHSA-p9wc-4pjv-rg82` · Packagist `phpmyfaq/phpmyfaq` and 1 more: affected `<4.1.2`, fixed in `4.1.2` · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 15 May 2026 · Tags: SQL injection
- [Duplicate Advisory: phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha](https://agentprime.io/advisories/GHSA-ch9q-c9mp-j5gq.md)
  `GHSA-ch9q-c9mp-j5gq` · Packagist `phpmyfaq/phpmyfaq` and 1 more: affected `<4.1.2`, fixed in `4.1.2` · CVSS 9.8 Critical · Withdrawn · Not analysed yet · Published 15 May 2026 · Tags: SQL injection
- [Vvveb: Authenticated SQL injection in /user/orders via order_by and direction](https://agentprime.io/advisories/CVE-2026-45800.md)
  `CVE-2026-45800` · CVE record: givanz Vvveb · CVSS 8.7 High · Not analysed yet · Published 15 May 2026 · Tags: SQL injection
- [PHP Timeclock 1.04 SQL Injection via login.php](https://agentprime.io/advisories/CVE-2021-47966.md)
  `CVE-2021-47966` · CVE record: Timeclock PHP Timeclock · CVSS 8.8 High · Not analysed yet · Published 15 May 2026 · Tags: SQL injection
- [NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter](https://agentprime.io/advisories/CVE-2026-7046.md)
  `CVE-2026-7046` · CVE record: webaways NEX-Forms – Ultimate Forms Plugin for WordPress · CVSS 4.9 Medium · Not analysed yet · Published 15 May 2026 · Tags: SQL injection
- [Marten has an injection vulnerability in its full-text search regConfig parameter](https://agentprime.io/advisories/GHSA-vmw2-qwm8-x84c.md)
  `GHSA-vmw2-qwm8-x84c`, `CVE-2026-45288` · NuGet `Marten`: affected `<8.37.0`, fixed in `8.37.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2026 · Tags: Other injection, SQL injection
- [ClipBucket: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')](https://agentprime.io/advisories/CVE-2026-42847.md)
  `CVE-2026-42847` · CVE record: MacWarrior clipbucket-v5 · CVSS 7.1 High · Not analysed yet · Published 14 May 2026 · Tags: SQL injection
- [n8n Has a Source Control Pull SQL Injection](https://agentprime.io/advisories/GHSA-mhrx-qhrj-673w.md)
  `GHSA-mhrx-qhrj-673w`, `CVE-2026-44792` · npm `n8n`: affected `<1.123.43 || >=2.0.0-rc.0, <2.20.7 || >=2.21.0, <2.21.1`, fixed in `1.123.43`, `2.20.7`, `2.21.1` · CVSS 8.9 High · Not analysed yet · Published 14 May 2026 · Tags: SQL injection
- [PostgreSQL REFRESH PUBLICATION allows SQL injection via table name](https://agentprime.io/advisories/CVE-2026-6638.md)
  `CVE-2026-6638` · CVE record: PostgreSQL · CVSS 3.7 Low · Not analysed yet · Published 14 May 2026 · Tags: SQL injection
- [PostgreSQL refint allows stack buffer overflow and SQL injection](https://agentprime.io/advisories/CVE-2026-6637.md)
  `CVE-2026-6637` · CVE record: PostgreSQL · CVSS 8.8 High · Not analysed yet · Published 14 May 2026 · Tags: SQL injection, Memory corruption
- [PostgreSQL pg_createsubscriber allows SQL injection via subscription name](https://agentprime.io/advisories/CVE-2026-6476.md)
  `CVE-2026-6476` · CVE record: PostgreSQL · CVSS 7.2 High · Not analysed yet · Published 14 May 2026 · Tags: SQL injection
- [SQLi in Akıllı Ticaret's E-Commerce Pack](https://agentprime.io/advisories/CVE-2025-11024.md)
  `CVE-2025-11024` · CVE record: Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2026 · Tags: SQL injection
- [Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.6 - Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project_search' Parameter](https://agentprime.io/advisories/CVE-2026-6225.md)
  `CVE-2026-6225` · CVE record: taskbuilder Taskbuilder – Project Management & Task Management Tool With Kanban Board · CVSS 6.5 Medium · Not analysed yet · Published 14 May 2026 · Tags: SQL injection
- [SQL injection in Alinto SOGo](https://agentprime.io/advisories/CVE-2026-46446.md)
  `CVE-2026-46446` · CVE record: Alinto SOGo · CVSS 7.1 High · Not analysed yet · Published 14 May 2026 · Tags: SQL injection
- [SQL injection in Alinto SOGo](https://agentprime.io/advisories/CVE-2026-46445.md)
  `CVE-2026-46445` · CVE record: Alinto SOGo · CVSS 7.1 High · Not analysed yet · Published 14 May 2026 · Tags: SQL injection
- [Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter](https://agentprime.io/advisories/CVE-2026-5486.md)
  `CVE-2026-5486` · CVE record: unitecms Unlimited Elements For Elementor · CVSS 6.5 Medium · Not analysed yet · Published 14 May 2026 · Tags: SQL injection
- [SQL injection in WebPros cPanel and others](https://agentprime.io/advisories/CVE-2026-29206.md)
  `CVE-2026-29206` · CVE record: WebPros cPanel and 2 more · CVSS 8.1 High · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [ERPNext: Possibility of SQL Injection due to missing validation](https://agentprime.io/advisories/CVE-2026-44447.md)
  `CVE-2026-44447` · CVE record: frappe erpnext · CVSS 8.8 High · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [ERPNext: Possibility of SQL Injection due to missing validation](https://agentprime.io/advisories/CVE-2026-44446.md)
  `CVE-2026-44446` · CVE record: frappe erpnext · CVSS 8.8 High · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [Incomplete fix for CVE-2026-35184: SQL Injection in phili67/ecclesiacrm](https://agentprime.io/advisories/CVE-2026-44418.md)
  `CVE-2026-44418` · CVE record: phili67 ecclesiacrm · CVSS 8.7 High · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings](https://agentprime.io/advisories/CVE-2026-44381.md)
  `CVE-2026-44381` · CVE record: MISP MISP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [CubeCart: Authenticated SQL Injection via \`sort\[\]\` Parameter in Admin Orders Transactions Listing](https://agentprime.io/advisories/CVE-2026-45054.md)
  `CVE-2026-45054` · CVE record: cubecart v6 · CVSS 4.9 Medium · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [CubeCart: Time-based Blind SQL Injection](https://agentprime.io/advisories/CVE-2026-39358.md)
  `CVE-2026-39358` · CVE record: cubecart v6 · CVSS 7.2 High · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [Strapi Vulnerable to SQL Injection in Content Type Builder](https://agentprime.io/advisories/GHSA-3xcq-8mjw-h6mx.md)
  `GHSA-3xcq-8mjw-h6mx`, `CVE-2026-22599` · npm `@strapi/content-type-builder` and 1 more: affected `>=5.0.0, <5.33.2`, fixed in `5.33.2` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [Trust Protection Foundation: SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-0242.md)
  `CVE-2026-0242` · CVE record: Palo Alto Networks Trust Protection Foundation · CVSS 6.1 Medium · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby](https://agentprime.io/advisories/CVE-2020-37226.md)
  `CVE-2020-37226` · CVE record: Joomsky J2 JOBS · CVSS 7.1 High · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby](https://agentprime.io/advisories/CVE-2020-37224.md)
  `CVE-2020-37224` · CVE record: Joomsky J2 JOBS · CVSS 7.1 High · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [Joomla com_hdwplayer 4.2 SQL Injection via search.php](https://agentprime.io/advisories/CVE-2020-37218.md)
  `CVE-2020-37218` · CVE record: Hdwplayer com_hdwplayer · CVSS 8.8 High · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter](https://agentprime.io/advisories/CVE-2026-4608.md)
  `CVE-2026-4608` · CVE record: metagauss ProfileGrid – User Profiles, Groups and Communities · CVSS 6.5 Medium · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter](https://agentprime.io/advisories/CVE-2026-4798.md)
  `CVE-2026-4798` · CVE record: themefusion Avada (Fusion) Builder · CVSS 7.5 High · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter](https://agentprime.io/advisories/CVE-2026-6929.md)
  `CVE-2026-6929` · CVE record: beardev JoomSport – for Sports: Team & League, Football, Hockey & more · CVSS 7.5 High · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter](https://agentprime.io/advisories/CVE-2026-7619.md)
  `CVE-2026-7619` · CVE record: smub Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More · CVSS 6.5 Medium · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-6888.md)
  `CVE-2026-6888` · CVE record: Advantech SaaS Composer and 4 more · CVSS 7.2 High · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysUserMapper.xml file.](https://agentprime.io/advisories/CVE-2026-37429.md)
  `CVE-2026-37429` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysDeptMapper.xml file.](https://agentprime.io/advisories/CVE-2026-37428.md)
  `CVE-2026-37428` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [Court Reservation – Manage Your Court Bookings Online <= 1.10.11 - Unauthenticated SQL Injection](https://agentprime.io/advisories/CVE-2026-1250.md)
  `CVE-2026-1250` · CVE record: webmuehle Court Reservation – Manage Your Court Bookings Online · CVSS 7.5 High · Not analysed yet · Published 12 May 2026 · Tags: SQL injection
- [Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems](https://agentprime.io/advisories/CVE-2026-44864.md)
  `CVE-2026-44864` · CVE record: Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: SQL injection
- [Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems](https://agentprime.io/advisories/CVE-2026-44863.md)
  `CVE-2026-44863` · CVE record: Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: SQL injection
- [Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems](https://agentprime.io/advisories/CVE-2026-44862.md)
  `CVE-2026-44862` · CVE record: Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: SQL injection
- [Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems](https://agentprime.io/advisories/CVE-2026-44861.md)
  `CVE-2026-44861` · CVE record: Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: SQL injection
- [Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems](https://agentprime.io/advisories/CVE-2026-44860.md)
  `CVE-2026-44860` · CVE record: Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: SQL injection
- [Shelf: SQL Injection via sortBy Parameter](https://agentprime.io/advisories/CVE-2026-44204.md)
  `CVE-2026-44204` · CVE record: Shelf-nu shelf.nu · CVSS 6.5 Medium · Not analysed yet · Published 12 May 2026 · Tags: SQL injection, CWE-20
- [SQL injection in Fortinet FortiMail](https://agentprime.io/advisories/CVE-2025-53681.md)
  `CVE-2025-53681` · CVE record: Fortinet FortiMail · CVSS 6.3 Medium · Not analysed yet · Published 12 May 2026 · Tags: SQL injection
- [SQL injection in Fortinet FortiNDR](https://agentprime.io/advisories/CVE-2026-25088.md)
  `CVE-2026-25088` · CVE record: Fortinet FortiNDR · CVSS 4.9 Medium · Not analysed yet · Published 12 May 2026 · Tags: SQL injection
- [SQL Injection in Graph Container Parameter](https://agentprime.io/advisories/CVE-2026-34187.md)
  `CVE-2026-34187` · CVE record: Pandora FMS Pandora FMS · CVSS 7.6 High · Not analysed yet · Published 12 May 2026 · Tags: SQL injection
- [SQL injection in ivanti Endpoint Manager](https://agentprime.io/advisories/CVE-2026-8111.md)
  `CVE-2026-8111` · CVE record: ivanti Endpoint Manager · CVSS 8.8 High · Not analysed yet · Published 12 May 2026 · Tags: SQL injection
- [SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3](https://agentprime.io/advisories/GHSA-r73h-97w8-m54h.md)
  `GHSA-r73h-97w8-m54h`, `CVE-2026-32687`, `EEF-CVE-2026-32687` · Hex `postgrex`: affected `>=0.16.0, <0.22.2`, fixed in `0.22.2` · CVSS 7.5 High · Not analysed yet · Published 12 May 2026 · Tags: SQL injection
- [SQL injection in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2026-27851.md)
  `CVE-2026-27851` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 7.4 High · Not analysed yet · Published 12 May 2026 · Tags: SQL injection, CWE-235
- [WordPress WP Travel plugin <= 11.4.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-45218.md)
  `CVE-2026-45218` · CVE record: WP Travel WP Travel · CVSS 7.7 High · Not analysed yet · Published 12 May 2026 · Tags: SQL injection
- [WordPress Xpro Elementor Addons plugin <= 1.5.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-45214.md)
  `CVE-2026-45214` · CVE record: Xpro Xpro Elementor Addons · CVSS 8.5 High · Not analysed yet · Published 12 May 2026 · Tags: SQL injection
- [WordPress BEAR plugin <= 1.1.7.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-45213.md)
  `CVE-2026-45213` · CVE record: RealMag777 BEAR · CVSS 7.6 High · Not analysed yet · Published 12 May 2026 · Tags: SQL injection
- [WordPress APIExperts Square for WooCommerce plugin <= 4.7.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-45211.md)
  `CVE-2026-45211` · CVE record: Saad Iqbal APIExperts Square for WooCommerce · CVSS 8.5 High · Not analysed yet · Published 12 May 2026 · Tags: SQL injection
- [WordPress Views for WPForms plugin <= 3.4.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42742.md)
  `CVE-2026-42742` · CVE record: Aman Views for WPForms · CVSS 8.5 High · Not analysed yet · Published 12 May 2026 · Tags: SQL injection

Newest: <https://agentprime.io/advisories/tag/sql-injection.md>
Older: <https://agentprime.io/advisories/tag/sql-injection.md?cursor=WyIyMDI2LTA1LTEyVDExOjAyOjA5LjkxMDAwMFoiLCJDVkUtMjAyNi00Mjc0MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=sql-injection&cursor=WyIyMDI2LTA1LTE3VDA1OjAwOjEyLjEyMjAwMFoiLCJDVkUtMjAyNi04NzM0Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/sql-injection/?cursor=WyIyMDI2LTA1LTE3VDA1OjAwOjEyLjEyMjAwMFoiLCJDVkUtMjAyNi04NzM0Il0>. Everything for agents: <https://agentprime.io/llms.txt>.