# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [WordPress Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend plugin <= 3.3.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42741.md) `CVE-2026-42741` · CVE record: Aman Ninja Forms Views \– Display \& Edit Ninja Forms Submissions on your site frontend · CVSS 8.5 High · Not analysed yet · Published 12 May 2026 · Tags: SQL injection - [SQLi in Akilli Commerce's E-Commerce Website](https://agentprime.io/advisories/CVE-2025-6577.md) `CVE-2025-6577` · CVE record: Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: SQL injection - [SQL injection in Siemens blueplanet 100 NX3 M8 and others](https://agentprime.io/advisories/CVE-2026-41125.md) `CVE-2026-41125` · CVE record: Siemens blueplanet 100 NX3 M8 and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 12 May 2026 · Tags: SQL injection - [Eight Day Week Print Workflow <= 1.2.6 - Authenticated (Subscriber+) SQL Injection via 'title' Parameter](https://agentprime.io/advisories/CVE-2026-5028.md) `CVE-2026-5028` · CVE record: 10up Eight Day Week Print Workflow · CVSS 6.5 Medium · Not analysed yet · Published 12 May 2026 · Tags: SQL injection - [AI Chatbot & Workflow Automation by AIWU <= 1.4.17 - Unauthenticated SQL Injection in getListForTbl()](https://agentprime.io/advisories/CVE-2026-2993.md) `CVE-2026-2993` · CVE record: wupsales AI Chatbot & Workflow Automation by AIWU · CVSS 7.5 High · Not analysed yet · Published 12 May 2026 · Tags: SQL injection - [SQL Injection vulnerability in SAP HANA Deployment Infrastructure (HDI) deploy library](https://agentprime.io/advisories/CVE-2026-40131.md) `CVE-2026-40131` · CVE record: SAP_SE SAP HANA Deployment Infrastructure (HDI) deploy library · CVSS 3.4 Low · Not analysed yet · Published 12 May 2026 · Tags: SQL injection - [SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP)](https://agentprime.io/advisories/CVE-2026-34260.md) `CVE-2026-34260` · CVE record: SAP_SE SAP S/4HANA (SAP Enterprise Search for ABAP) · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: SQL injection - [Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in \`JSONPathBuilder.key()\` / \`.at()\`](https://agentprime.io/advisories/GHSA-pv5w-4p9q-p3v2.md) `GHSA-pv5w-4p9q-p3v2`, `CVE-2026-44635` · npm `kysely`: affected `>=0.26.0, <0.28.17`, fixed in `0.28.17` · CVSS 7.5 High · Not analysed yet · Published 11 May 2026 · Tags: Path traversal, SQL injection, Broken access control, CWE-1284 - [pgAdmin 4: OS command injection vulnerability in Import/Export query export](https://agentprime.io/advisories/GHSA-j74f-g7vx-fh4x.md) `GHSA-j74f-g7vx-fh4x`, `CVE-2026-7816`, `PYSEC-2026-2870` · PyPI `pgadmin4`: affected `<9.15`, fixed in `9.15` · CVSS 8.7 High · Not analysed yet · Published 11 May 2026 · Tags: Command injection, SQL injection - [SQL injection vulnerability in pgAdmin 4 Maintenance Tool](https://agentprime.io/advisories/GHSA-hp84-p2gq-6fvr.md) `GHSA-hp84-p2gq-6fvr`, `CVE-2026-7815`, `PYSEC-2026-2867` · PyPI `pgadmin4`: affected `<9.15`, fixed in `9.15` · CVSS 8.7 High · Not analysed yet · Published 11 May 2026 · Tags: SQL injection - [elFinder MySQL has a SQL Injection in its Volume Driver (elFinderVolumeMySQL)](https://agentprime.io/advisories/GHSA-c3gj-q88f-7hqj.md) `GHSA-c3gj-q88f-7hqj`, `CVE-2026-44521`, `PKSA-42xd-jnjn-nrty` · Packagist `studio-42/elfinder`: affected `<2.1.68`, fixed in `2.1.68` · CVSS 8.8 High · Not analysed yet · Published 11 May 2026 · Tags: SQL injection - [Corteza 2024.9.8 - SQL Injection in MSSQL JSON-path meta filter via incorrect T-SQL string escaping](https://agentprime.io/advisories/CVE-2026-6093.md) `CVE-2026-6093` · CVE record: cortezaproject corteza · CVSS 6.0 Medium · Not analysed yet · Published 11 May 2026 · Tags: SQL injection - [PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries](https://agentprime.io/advisories/GHSA-3643-7v76-5cj2.md) `GHSA-3643-7v76-5cj2`, `CVE-2026-44337`, `PYSEC-2026-2897` · PyPI `praisonai`: affected `>=2.4.1, <4.6.34`, fixed in `4.6.34` · CVSS 6.3 Medium · Not analysed yet · Published 11 May 2026 · Tags: SQL injection, CWE-20 - [HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints.](https://agentprime.io/advisories/CVE-2026-38567.md) `CVE-2026-38567` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 May 2026 · Tags: SQL injection - [SQL Injection in MuuCMF T6 v1.9.4.20260115 allows an unauthenticated attacker to compromise the entire database, achieve unauthorized administrative access, and potentially gain remote code execution…](https://agentprime.io/advisories/CVE-2026-36962.md) `CVE-2026-36962` · CVE record · CVSS 7.3 High · Not analysed yet · Published 11 May 2026 · Tags: SQL injection - [WordPress Plugin Survey & Poll 1.5.7.3 SQL Injection via sss_params](https://agentprime.io/advisories/CVE-2021-47941.md) `CVE-2021-47941` · CVE record: Modalsurvey Survey & Poll · CVSS 8.8 High · Not analysed yet · Published 10 May 2026 · Tags: SQL injection - [Balbooa Joomla Forms Builder 2.0.6 SQL Injection Unauthenticated](https://agentprime.io/advisories/CVE-2021-47930.md) `CVE-2021-47930` · CVE record: Balbooa Balbooa Joomla Forms Builder · CVSS 8.8 High · Not analysed yet · Published 10 May 2026 · Tags: SQL injection - [Opencart TMD Vendor System 3.x Blind SQL Injection via product route](https://agentprime.io/advisories/CVE-2021-47928.md) `CVE-2021-47928` · CVE record: opencartextensions Extension TMD Vendor System · CVSS 8.8 High · Not analysed yet · Published 10 May 2026 · Tags: SQL injection - [CodeAstro Online Catering Ordering System deleteorder.php sql injection](https://agentprime.io/advisories/CVE-2026-8231.md) `CVE-2026-8231` · CVE record: CodeAstro Online Catering Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 10 May 2026 · Tags: Other injection, SQL injection - [SQL injection in pdo_firebird via NUL bytes in quoted strings](https://agentprime.io/advisories/CVE-2025-14179.md) `CVE-2025-14179` · CVE record: PHP Group PHP · CVSS 7.4 High · Not analysed yet · Published 10 May 2026 · Tags: SQL injection - [SQL injection in gibbon](https://agentprime.io/advisories/CVE-2026-8207.md) `CVE-2026-8207` · CVE record: gibbonedu gibbon · CVSS 7.0 High · Not analysed yet · Published 9 May 2026 · Tags: SQL injection - [Emlog: SQL Injection Vulnerability in log_model.php within addLog() and updateLog() Functions](https://agentprime.io/advisories/CVE-2026-42287.md) `CVE-2026-42287` · CVE record: emlog emlog · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 May 2026 · Tags: SQL injection - [MikroORM has SQL injection via runtime-controlled identifiers and JSON-path keys](https://agentprime.io/advisories/GHSA-cfw5-68c4-ffqp.md) `GHSA-cfw5-68c4-ffqp`, `CVE-2026-44680` · npm `@mikro-orm/knex` and 1 more: affected `<6.6.14`, fixed in `6.6.14` · CVSS 7.6 High · Not analysed yet · Published 8 May 2026 · Tags: SQL injection - [SureTriggers < 1.1.23 – Unauthenticated SQLi](https://agentprime.io/advisories/CVE-2026-4935.md) `CVE-2026-4935` · CVE record: Unknown OttoKit: All-in-One Automation Platform · CVSS 8.6 High · Not analysed yet · Published 8 May 2026 · Tags: SQL injection - [zyx0814 FilePress Shares Filelist API admin.php sql injection](https://agentprime.io/advisories/CVE-2026-8133.md) `CVE-2026-8133` · CVE record: zyx0814 FilePress · CVSS 6.9 Medium · Not analysed yet · Published 8 May 2026 · Tags: Other injection, SQL injection - [CodeAstro Leave Management System login.php sql injection](https://agentprime.io/advisories/CVE-2026-8132.md) `CVE-2026-8132` · CVE record: CodeAstro Leave Management System · CVSS 6.9 Medium · Not analysed yet · Published 8 May 2026 · Tags: Other injection, SQL injection - [SourceCodester SUP Online Shopping replymsg.php sql injection](https://agentprime.io/advisories/CVE-2026-8131.md) `CVE-2026-8131` · CVE record: SourceCodester SUP Online Shopping · CVSS 6.9 Medium · Not analysed yet · Published 8 May 2026 · Tags: Other injection, SQL injection - [SourceCodester SUP Online Shopping message.php sql injection](https://agentprime.io/advisories/CVE-2026-8130.md) `CVE-2026-8130` · CVE record: SourceCodester SUP Online Shopping · CVSS 6.9 Medium · Not analysed yet · Published 8 May 2026 · Tags: Other injection, SQL injection - [SourceCodester SUP Online Shopping wishlist.php sql injection](https://agentprime.io/advisories/CVE-2026-8129.md) `CVE-2026-8129` · CVE record: SourceCodester SUP Online Shopping · CVSS 6.9 Medium · Not analysed yet · Published 8 May 2026 · Tags: Other injection, SQL injection - [SourceCodester SUP Online Shopping viewmsg.php sql injection](https://agentprime.io/advisories/CVE-2026-8128.md) `CVE-2026-8128` · CVE record: SourceCodester SUP Online Shopping · CVSS 6.9 Medium · Not analysed yet · Published 8 May 2026 · Tags: Other injection, SQL injection - [SourceCodester Comment System post_comment.php sql injection](https://agentprime.io/advisories/CVE-2026-8126.md) `CVE-2026-8126` · CVE record: SourceCodester Comment System · CVSS 6.9 Medium · Not analysed yet · Published 8 May 2026 · Tags: Other injection, SQL injection - [code-projects Simple Chat System sendMessage.php sql injection](https://agentprime.io/advisories/CVE-2026-8125.md) `CVE-2026-8125` · CVE record: code-projects Simple Chat System · CVSS 5.3 Medium · Not analysed yet · Published 8 May 2026 · Tags: Other injection, SQL injection - [Beauty Parlour Management System v1.1 was discovered to contain a SQL injection vulnerability via the aptnumber parameter in the /appointment-detail.php endpoint.](https://agentprime.io/advisories/CVE-2026-37431.md) `CVE-2026-37431` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 May 2026 · Tags: SQL injection - [SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut\[\].](https://agentprime.io/advisories/CVE-2024-33722.md) `CVE-2024-33722` · CVE record · CVSS 6.3 Medium · Not analysed yet · Published 8 May 2026 · Tags: SQL injection - [Prison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability via the username on the Admin login page.](https://agentprime.io/advisories/CVE-2024-33288.md) `CVE-2024-33288` · CVE record · CVSS 7.3 High · Not analysed yet · Published 8 May 2026 · Tags: SQL injection - [Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username that is both a valid SQL statement and a valid regular express…](https://agentprime.io/advisories/CVE-2023-46453.md) `CVE-2023-46453` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 May 2026 · Tags: SQL injection - [JeecgBoot JSON Object loadTreeData sql injection](https://agentprime.io/advisories/CVE-2026-8114.md) `CVE-2026-8114` · CVE record: JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 7 May 2026 · Tags: Other injection, SQL injection - [code-projects Feedback System checklogin.php sql injection](https://agentprime.io/advisories/CVE-2026-8098.md) `CVE-2026-8098` · CVE record: code-projects Feedback System · CVSS 6.9 Medium · Not analysed yet · Published 7 May 2026 · Tags: Other injection, SQL injection - [CodeAstro Online Classroom askquery.php sql injection](https://agentprime.io/advisories/CVE-2026-8097.md) `CVE-2026-8097` · CVE record: CodeAstro Online Classroom · CVSS 5.3 Medium · Not analysed yet · Published 7 May 2026 · Tags: Other injection, SQL injection - [SourceCodester Pharmacy Sales and Inventory System ajax.php save_user sql injection](https://agentprime.io/advisories/CVE-2026-8083.md) `CVE-2026-8083` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 7 May 2026 · Tags: Other injection, SQL injection - [WordPress Team Member plugin <= 8.5 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2025-68060.md) `CVE-2025-68060` · CVE record: WPMart Team Member · CVSS 7.6 High · Not analysed yet · Published 7 May 2026 · Tags: SQL injection - [BetterDocs Pro <= 3.7.0 - Unauthenticated SQL Injection via Encyclopedia 'limit' Parameter](https://agentprime.io/advisories/CVE-2026-4348.md) `CVE-2026-4348` · CVE record: betterdocs BetterDocs Pro · CVSS 7.5 High · Not analysed yet · Published 7 May 2026 · Tags: SQL injection - [Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening](https://agentprime.io/advisories/GHSA-9h64-2846-7x7f.md) `GHSA-9h64-2846-7x7f`, `GO-2026-5290` · Go `github.com/getaxonflow/axonflow`: affected `<7.5.0`, fixed in `7.5.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 May 2026 · Tags: SQL injection, Information disclosure, Denial of service, Broken access control - [Daptin fuzzy search injects unvalidated column name into raw SQL](https://agentprime.io/advisories/GHSA-pwqg-q8pg-pp6r.md) `GHSA-pwqg-q8pg-pp6r`, `CVE-2026-44349`, `GO-2026-5555` · Go `github.com/daptin/daptin`: affected `<0.11.5`, fixed in `0.11.5` · CVSS 7.1 High · Not analysed yet · Published 6 May 2026 · Tags: SQL injection - [Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete](https://agentprime.io/advisories/GHSA-xwqr-rcqg-22mr.md) `GHSA-xwqr-rcqg-22mr`, `CVE-2026-42550`, `PKSA-jtc2-k2n3-ck2b` · Packagist `flightphp/core`: affected `<3.18.1`, fixed in `3.18.1` · CVSS 8.8 High · Not analysed yet · Published 6 May 2026 · Tags: SQL injection - [phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha](https://agentprime.io/advisories/GHSA-289f-fq7w-6q2w.md) `GHSA-289f-fq7w-6q2w`, `CVE-2026-46364`, `PKSA-6nrc-qfr1-rds3`, `PKSA-trv8-7xnx-t8d9` · Packagist `phpmyfaq/phpmyfaq` and 1 more: affected `<4.1.2`, fixed in `4.1.2` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 May 2026 · Tags: SQL injection - [phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields](https://agentprime.io/advisories/GHSA-pm8c-3qq3-72w7.md) `GHSA-pm8c-3qq3-72w7`, `CVE-2026-46359`, `PKSA-n87n-9t5q-zcf5`, `PKSA-r4gq-dd3d-gxrj` · Packagist `phpmyfaq/phpmyfaq` and 1 more: affected `<4.1.2`, fixed in `4.1.2` · CVSS 7.7 High · Not analysed yet · Published 6 May 2026 · Tags: SQL injection - [Gravity Bookings <= 2.5.9 - Unauthenticated SQL Injection via 'category_id' Parameter](https://agentprime.io/advisories/CVE-2026-1719.md) `CVE-2026-1719` · CVE record: GravityMore Gravity Bookings · CVSS 7.5 High · Not analysed yet · Published 6 May 2026 · Tags: SQL injection - [YAFNET: Pre-Handler Authorization Bypass on Admin Pages Enables Blind SQL Execution via \`/Admin/RunSql\`](https://agentprime.io/advisories/GHSA-xhw7-j96h-c3g5.md) `GHSA-xhw7-j96h-c3g5`, `CVE-2026-43937` · NuGet `YAFNET.Core`: affected `<4.0.5`, fixed in `4.0.5` · CVSS 8.8 High · Not analysed yet · Published 5 May 2026 · Tags: SQL injection, CWE-841 - [Masa CMS unauthenticated SQL injection via altTable parameter in JSON API](https://agentprime.io/advisories/CVE-2026-40331.md) `CVE-2026-40331` · CVE record: MasaCMS MasaCMS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2026 · Tags: SQL injection - [Masa CMS SQL injection via sortDirection parameter in beanFeed](https://agentprime.io/advisories/CVE-2026-40330.md) `CVE-2026-40330` · CVE record: MasaCMS MasaCMS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2026 · Tags: SQL injection - [SQL Injection vulnerability via sortBy in beanFeed](https://agentprime.io/advisories/CVE-2026-40329.md) `CVE-2026-40329` · CVE record: MasaCMS MasaCMS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2026 · Tags: SQL injection - [SQL injection in ProFTPD](https://agentprime.io/advisories/CVE-2026-44331.md) `CVE-2026-44331` · CVE record: ProFTPD ProFTPD · CVSS 8.1 High · Not analysed yet · Published 5 May 2026 · Tags: SQL injection - [SQLBot prompt injection allows arbitrary SQL execution and remote code execution](https://agentprime.io/advisories/CVE-2026-33324.md) `CVE-2026-33324` · CVE record: dataease SQLBot · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2026 · Tags: SQL injection - [WeePie Cookie Allow <= 3.4.11 - Unauthenticated SQL Injection via 'consent' Parameter](https://agentprime.io/advisories/CVE-2026-4304.md) `CVE-2026-4304` · CVE record: WeePie WeePie Cookie Allow · CVSS 7.5 High · Not analysed yet · Published 5 May 2026 · Tags: SQL injection - [Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'](https://agentprime.io/advisories/CVE-2026-3359.md) `CVE-2026-3359` · CVE record: 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder · CVSS 7.5 High · Not analysed yet · Published 5 May 2026 · Tags: SQL injection - [WordPress WebinarIgnition plugin <= 4.08.253 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40797.md) `CVE-2026-40797` · CVE record: Saleswonder LLC WebinarIgnition · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2026 · Tags: SQL injection - [itsourcecode Courier Management System print_pdets.php sql injection](https://agentprime.io/advisories/CVE-2026-7822.md) `CVE-2026-7822` · CVE record: itsourcecode Courier Management System · CVSS 5.3 Medium · Not analysed yet · Published 5 May 2026 · Tags: Other injection, SQL injection - [GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.2.0 - Unauthenticated SQL Injection via 'attributekey'](https://agentprime.io/advisories/CVE-2026-3456.md) `CVE-2026-3456` · CVE record: ahmadgb GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content · CVSS 7.5 High · Not analysed yet · Published 5 May 2026 · Tags: SQL injection - [SQL injection in Oracle Corporation Oracle MCP Server Helper Tool product of Oracle Open Source…](https://agentprime.io/advisories/CVE-2026-35228.md) `CVE-2026-35228` · CVE record: Oracle Corporation Oracle MCP Server Helper Tool product of Oracle Open Source Projects · CVSS 8.7 High · Not analysed yet · Published 5 May 2026 · Tags: SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .