# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [code-projects Employee Management System changepassemp.php sql injection](https://agentprime.io/advisories/CVE-2026-9449.md) `CVE-2026-9449` · CVE record: code-projects Employee Management System · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection - [SourceCodester Simple POS and Inventory System search.php sql injection](https://agentprime.io/advisories/CVE-2026-9447.md) `CVE-2026-9447` · CVE record: SourceCodester Simple POS and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection - [SourceCodester Simple POS and Inventory System edit_customer.php sql injection](https://agentprime.io/advisories/CVE-2026-9446.md) `CVE-2026-9446` · CVE record: SourceCodester Simple POS and Inventory System · CVSS 5.1 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection - [SourceCodester Simple POS and Inventory System GET Parameter deleteproduct.php delete sql injection](https://agentprime.io/advisories/CVE-2026-9444.md) `CVE-2026-9444` · CVE record: SourceCodester Simple POS and Inventory System · CVSS 5.1 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection - [SourceCodester Indian Invoicing System Invoice Generation IGST_Invoice.php sql injection](https://agentprime.io/advisories/CVE-2026-9411.md) `CVE-2026-9411` · CVE record: SourceCodester Indian Invoicing System · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection - [itsourcecode Electronic Judging System login.php sql injection](https://agentprime.io/advisories/CVE-2026-9383.md) `CVE-2026-9383` · CVE record: itsourcecode Electronic Judging System · CVSS 6.9 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, SQL injection - [projectworlds Online Art Gallery Shop adminHome.php sql injection](https://agentprime.io/advisories/CVE-2026-9364.md) `CVE-2026-9364` · CVE record: projectworlds Online Art Gallery Shop · CVSS 6.9 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, SQL injection - [SourceCodester Hospitals Patient Records Management System manage_history.php sql injection](https://agentprime.io/advisories/CVE-2026-9356.md) `CVE-2026-9356` · CVE record: SourceCodester Hospitals Patient Records Management System · CVSS 6.9 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, SQL injection - [SourceCodester Hospitals Patient Records Management System Master.php save_patient_history sql injection](https://agentprime.io/advisories/CVE-2026-9355.md) `CVE-2026-9355` · CVE record: SourceCodester Hospitals Patient Records Management System · CVSS 6.9 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, SQL injection - [SourceCodester Hospitals Patient Records Management System view_history.php sql injection](https://agentprime.io/advisories/CVE-2026-9342.md) `CVE-2026-9342` · CVE record: SourceCodester Hospitals Patient Records Management System · CVSS 5.3 Medium · Not analysed yet · Published 23 May 2026 · Tags: Other injection, SQL injection - [WordPress Ultimate Form Builder Lite 1.3.7 SQL Injection via entry_id](https://agentprime.io/advisories/CVE-2018-25352.md) `CVE-2018-25352` · CVE record: ultimate-form-builder-lite Ultimate Form Builder Lite · CVSS 7.1 High · Not analysed yet · Published 23 May 2026 · Tags: SQL injection - [Joomla! Component EkRishta 2.10 SQL Injection via username](https://agentprime.io/advisories/CVE-2018-25351.md) `CVE-2018-25351` · CVE record: harmistechnology EkRishta · CVSS 8.8 High · Not analysed yet · Published 23 May 2026 · Tags: SQL injection - [Joomla! Component Ek Rishta 2.10 SQL Injection via user_detail](https://agentprime.io/advisories/CVE-2018-25348.md) `CVE-2018-25348` · CVE record: harmistechnology Ek Rishta · CVSS 8.8 High · Not analysed yet · Published 23 May 2026 · Tags: SQL injection - [WordPress Contact Form Maker Plugin 1.12.20 SQL Injection](https://agentprime.io/advisories/CVE-2018-25347.md) `CVE-2018-25347` · CVE record: web-dorado Contact Form Maker · CVSS 7.1 High · Not analysed yet · Published 23 May 2026 · Tags: SQL injection - [WordPress Form Maker Plugin 1.12.24 SQL Injection via admin-ajax.php](https://agentprime.io/advisories/CVE-2018-25346.md) `CVE-2018-25346` · CVE record: 10Web Form Maker · CVSS 7.1 High · Not analysed yet · Published 23 May 2026 · Tags: SQL injection - [Smartshop 1 SQL Injection via search.php](https://agentprime.io/advisories/CVE-2018-25342.md) `CVE-2018-25342` · CVE record: Behance Smartshop · CVSS 8.8 High · Not analysed yet · Published 23 May 2026 · Tags: SQL injection - [Smartshop 1 SQL Injection via product.php id Parameter](https://agentprime.io/advisories/CVE-2018-25341.md) `CVE-2018-25341` · CVE record: Behance Smartshop · CVSS 8.8 High · Not analysed yet · Published 23 May 2026 · Tags: SQL injection - [Smartshop 1 SQL Injection via category.php](https://agentprime.io/advisories/CVE-2018-25340.md) `CVE-2018-25340` · CVE record: Behance Smartshop · CVSS 8.8 High · Not analysed yet · Published 23 May 2026 · Tags: SQL injection - [QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection](https://agentprime.io/advisories/CVE-2026-9305.md) `CVE-2026-9305` · CVE record: QuantumNous new-api · CVSS 5.3 Medium · Not analysed yet · Published 23 May 2026 · Tags: Other injection, SQL injection - [RT: SQL injection via entry_aggregator parameter in JSON search](https://agentprime.io/advisories/CVE-2026-41075.md) `CVE-2026-41075` · CVE record: bestpractical rt · CVSS 8.8 High · Not analysed yet · Published 22 May 2026 · Tags: SQL injection - [YesWiki: Unauthenticated SQL Injection](https://agentprime.io/advisories/GHSA-jwvv-qr7q-cv8j.md) `GHSA-jwvv-qr7q-cv8j`, `CVE-2026-46670`, `PKSA-2myt-jw5p-f7jn` · Packagist `yeswiki/yeswiki`: affected `<4.6.4`, fixed in `4.6.4` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 May 2026 · Tags: SQL injection - [SQL Injection in STER](https://agentprime.io/advisories/CVE-2026-25606.md) `CVE-2026-25606` · CVE record: Centralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy STER · CVSS 8.7 High · Not analysed yet · Published 22 May 2026 · Tags: SQL injection - [WP ERP Pro <= 1.5.1 - Unauthenticated SQL Injection via 'search_key' Parameter](https://agentprime.io/advisories/CVE-2026-4834.md) `CVE-2026-4834` · CVE record: weDevs WP ERP Pro · CVSS 7.5 High · Not analysed yet · Published 22 May 2026 · Tags: SQL injection - [Open ISES Tickets < 3.44.2 SQL Injection via ajax/statistics.php tick_id and f_tick_id Parameters](https://agentprime.io/advisories/CVE-2026-48240.md) `CVE-2026-48240` · CVE record: Open ISES Tickets · CVSS 7.1 High · Not analysed yet · Published 21 May 2026 · Tags: SQL injection - [Open ISES Tickets < 3.44.2 SQL Injection via ajax/reports.php tick_id Parameter](https://agentprime.io/advisories/CVE-2026-48239.md) `CVE-2026-48239` · CVE record: Open ISES Tickets · CVSS 7.1 High · Not analysed yet · Published 21 May 2026 · Tags: SQL injection - [Open ISES Tickets < 3.44.2 SQL Injection via ajax/mobile_main.php id Parameter](https://agentprime.io/advisories/CVE-2026-48238.md) `CVE-2026-48238` · CVE record: Open ISES Tickets · CVSS 7.1 High · Not analysed yet · Published 21 May 2026 · Tags: SQL injection - [Open ISES Tickets < 3.44.2 SQL Injection via message.php frm_ticket_id and frm_resp_id Parameters](https://agentprime.io/advisories/CVE-2026-48237.md) `CVE-2026-48237` · CVE record: Open ISES Tickets · CVSS 7.1 High · Not analysed yet · Published 21 May 2026 · Tags: SQL injection - [Open ISES Tickets < 3.44.2 SQL Injection via db_loader.php Multiple Parameters](https://agentprime.io/advisories/CVE-2026-48236.md) `CVE-2026-48236` · CVE record: Open ISES Tickets · CVSS 7.1 High · Not analysed yet · Published 21 May 2026 · Tags: SQL injection - [Open ISES Tickets < 3.44.2 SQL Injection in incs/remotes.inc.php via External GPS Tracker Data](https://agentprime.io/advisories/CVE-2026-48235.md) `CVE-2026-48235` · CVE record: Open ISES Tickets · CVSS 8.8 High · Not analysed yet · Published 21 May 2026 · Tags: SQL injection - [Open ISES Tickets < 3.44.2 SQL Injection via portal/ajax/list_requests.php sort and dir Parameters](https://agentprime.io/advisories/CVE-2026-48234.md) `CVE-2026-48234` · CVE record: Open ISES Tickets · CVSS 7.1 High · Not analysed yet · Published 21 May 2026 · Tags: SQL injection - [Open ISES Tickets < 3.44.2 SQL Injection via ajax/sit_incidents.php offset Parameter](https://agentprime.io/advisories/CVE-2026-48233.md) `CVE-2026-48233` · CVE record: Open ISES Tickets · CVSS 7.1 High · Not analysed yet · Published 21 May 2026 · Tags: SQL injection - [Open ISES Tickets < 3.44.2 SQL Injection via ajax/fullsit_incidents.php offset Parameter](https://agentprime.io/advisories/CVE-2026-48232.md) `CVE-2026-48232` · CVE record: Open ISES Tickets · CVSS 7.1 High · Not analysed yet · Published 21 May 2026 · Tags: SQL injection - [Open ISES Tickets < 3.44.2 SQL Injection via tables.php Multiple Parameters](https://agentprime.io/advisories/CVE-2026-48231.md) `CVE-2026-48231` · CVE record: Open ISES Tickets · CVSS 7.1 High · Not analysed yet · Published 21 May 2026 · Tags: SQL injection - [WordPress WP Directory Kit plugin <= 1.5.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39531.md) `CVE-2026-39531` · CVE record: Wp Directory Kit WP Directory Kit · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 May 2026 · Tags: SQL injection - [SQL injection in MySQL CNID backend](https://agentprime.io/advisories/CVE-2026-44047.md) `CVE-2026-44047` · CVE record: Netatalk Netatalk · CVSS 8.8 High · Not analysed yet · Published 21 May 2026 · Tags: SQL injection - [Drupal Core has a SQL Injection issue](https://agentprime.io/advisories/GHSA-ghwc-95x2-682j.md) `GHSA-ghwc-95x2-682j`, `BIT-drupal-2026-9082`, `CVE-2026-9082`, `DRUPAL-CORE-2026-004`, `PKSA-h76q-q9b2-4kdc` · Packagist `drupal/core`: affected `>=8.9.0, <10.4.10 || >=10.5.0, <10.5.10 || >=10.6.0, <10.6.9 || >=11.0.0, <11.1.10 || >=11.2.0, <11.2.12 || >=11.3.0, <11.3.10`, fixed in `10.4.10`, `10.5.10`, `10.6.9`, `11.1.10`, `11.2.12`, `11.3.10` · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.89 · Not analysed yet · Published 20 May 2026 · Tags: SQL injection - [WordPress YITH WooCommerce Product Add-Ons plugin <= 4.29.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42383.md) `CVE-2026-42383` · CVE record: YITH YITH WooCommerce Product Add-Ons · CVSS 7.6 High · Not analysed yet · Published 20 May 2026 · Tags: SQL injection - [Surecart - SQL Injection](https://agentprime.io/advisories/CVE-2026-9065.md) `CVE-2026-9065` · CVE record: brainstormforce Surecart · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 May 2026 · Tags: SQL injection - [NextGEN Gallery - SQL Injection](https://agentprime.io/advisories/CVE-2026-9059.md) `CVE-2026-9059` · CVE record: awesomemotive NextGEN Gallery · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 May 2026 · Tags: SQL injection - [TONNET｜E-LAN Hybrid Recording System - SQL Injection](https://agentprime.io/advisories/CVE-2026-9003.md) `CVE-2026-9003` · CVE record: TONNET TPR7308 · CVSS 8.7 High · Not analysed yet · Published 20 May 2026 · Tags: SQL injection - [Boost <= 2.0.3 - Unauthenticated Blind SQL Injection via Multiple Parameters](https://agentprime.io/advisories/CVE-2026-9010.md) `CVE-2026-9010` · CVE record: PixelYourSite Boost · CVSS 7.5 High · Not analysed yet · Published 20 May 2026 · Tags: SQL injection - [Read More & Accordion <= 3.5.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter](https://agentprime.io/advisories/CVE-2026-7472.md) `CVE-2026-7472` · CVE record: edmonparker Read More & Accordion · CVSS 4.9 Medium · Not analysed yet · Published 20 May 2026 · Tags: SQL injection - [Creative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Unauthenticated SQL Injection via 'checkout_uuid' Parameter](https://agentprime.io/advisories/CVE-2026-3985.md) `CVE-2026-3985` · CVE record: constantcontact Creative Mail – Easier WordPress & WooCommerce Email Marketing · CVSS 7.5 High · Not analysed yet · Published 20 May 2026 · Tags: SQL injection - [Infility Global <= 2.15.16 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter](https://agentprime.io/advisories/CVE-2026-8685.md) `CVE-2026-8685` · CVE record: infility Infility Global · CVSS 6.5 Medium · Not analysed yet · Published 20 May 2026 · Tags: SQL injection - [SQL injection in InfoScale VIOM before v9.1.3 allows remote attackers to escalate privileges.](https://agentprime.io/advisories/CVE-2026-44923.md) `CVE-2026-44923` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 20 May 2026 · Tags: SQL injection - [BillaBear is Vulnerable to SQL Injection in the EventRepository](https://agentprime.io/advisories/GHSA-xp6r-8pcc-xv5p.md) `GHSA-xp6r-8pcc-xv5p`, `CVE-2026-31069`, `PKSA-tks4-h5gc-8mrj` · Packagist `billabear/billabear`: affected `<=2025.01.03`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 19 May 2026 · Tags: SQL injection - [georgringer/news has SQL Injection in extension "News system" (news)](https://agentprime.io/advisories/GHSA-g868-j3qm-4j28.md) `GHSA-g868-j3qm-4j28`, `CVE-2026-8726`, `PKSA-grgc-xpj3-tvw1` · Packagist `georgringer/news`: affected `<10.0.4 || >=11.0.0, <11.4.4 || >=12.0.0, <12.3.2 || >=13.0.0, <13.0.2 || >=14.0.0, <14.0.3`, fixed in `10.0.4`, `11.4.4`, `12.3.2`, `13.0.2`, `14.0.3` · CVSS 8.2 High · Not analysed yet · Published 19 May 2026 · Tags: SQL injection - [TYPO3 SQL Injection in extension "Address List" (tt_address)](https://agentprime.io/advisories/GHSA-3h52-6v6j-6wwv.md) `GHSA-3h52-6v6j-6wwv`, `CVE-2026-8827`, `PKSA-s9h4-6qfr-k554` · Packagist `friendsoftypo3/tt-address`: affected `<8.1.2 || >=9.0.0, <9.1.1 || >=10.0.0, <10.0.1`, fixed in `8.1.2`, `9.1.1`, `10.0.1` · CVSS 8.2 High · Not analysed yet · Published 19 May 2026 · Tags: SQL injection - [Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection](https://agentprime.io/advisories/CVE-2026-8912.md) `CVE-2026-8912` · CVE record: contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: SQL injection - [SOGo < 5.12.8 SQL Injection via addUserInAcls endpoint](https://agentprime.io/advisories/CVE-2026-8851.md) `CVE-2026-8851` · CVE record: Alinto SOGo Webmail · CVSS 8.6 High · Not analysed yet · Published 18 May 2026 · Tags: SQL injection - [WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' Parameter](https://agentprime.io/advisories/CVE-2026-6379.md) `CVE-2026-6379` · CVE record: Unknown WP Photo Album Plus · CVSS 8.6 High · Not analysed yet · Published 18 May 2026 · Tags: SQL injection - [projectworlds hospital-management-system-in-php GET Parameter update_info.php getAllPatientDetail sql injection](https://agentprime.io/advisories/CVE-2026-8785.md) `CVE-2026-8785` · CVE record: projectworlds hospital-management-system-in-php · CVSS 6.9 Medium · Not analysed yet · Published 18 May 2026 · Tags: Other injection, SQL injection - [org.linlinjava:litemall-wx-api has an Injection issue](https://agentprime.io/advisories/GHSA-cvwm-vwhp-22jx.md) `GHSA-cvwm-vwhp-22jx`, `CVE-2026-8771` · Maven `org.linlinjava:litemall-wx-api`: affected `<=0.1.0`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 18 May 2026 · Tags: Other injection, SQL injection - [linlinjava litemall Admin Endpoint sql injection](https://agentprime.io/advisories/CVE-2026-8772.md) `CVE-2026-8772` · CVE record: linlinjava litemall · CVSS 5.1 Medium · Not analysed yet · Published 17 May 2026 · Tags: Other injection, SQL injection - [Zechat 1.5 SQL Injection via v parameter (time-based blind)](https://agentprime.io/advisories/CVE-2018-25339.md) `CVE-2018-25339` · CVE record: Bylancer Zechat · CVSS 8.8 High · Not analysed yet · Published 17 May 2026 · Tags: SQL injection - [Zechat 1.5 SQL Injection via hashtag parameter](https://agentprime.io/advisories/CVE-2018-25338.md) `CVE-2018-25338` · CVE record: Bylancer Zechat · CVSS 8.8 High · Not analysed yet · Published 17 May 2026 · Tags: SQL injection - [Nordex N149/4.0-4.5 Wind Turbine Web Server SQL Injection](https://agentprime.io/advisories/CVE-2018-25333.md) `CVE-2018-25333` · CVE record: nordex-online N149 Wind Turbine Web Server · CVSS 8.8 High · Not analysed yet · Published 17 May 2026 · Tags: SQL injection - [Joomla! EkRishta 2.10 Persistent XSS and SQL Injection](https://agentprime.io/advisories/CVE-2018-25330.md) `CVE-2018-25330` · CVE record: Joomlaextensions Joomla! extension EkRishta · CVSS 8.8 High · Not analysed yet · Published 17 May 2026 · Tags: SQL injection - [Redaxo CMS Addon MyEvents 2.2.1 SQL Injection via event_add.php](https://agentprime.io/advisories/CVE-2018-25319.md) `CVE-2018-25319` · CVE record: wende60 Redaxo CMS Addon MyEvents · CVSS 7.1 High · Not analysed yet · Published 17 May 2026 · Tags: SQL injection - [Oinone Pamirs queryListByWrapper RSQLToSQLNodeConnector.makeVariable sql injection](https://agentprime.io/advisories/CVE-2026-8734.md) `CVE-2026-8734` · CVE record: Oinone Pamirs · CVSS 6.9 Medium · Not analysed yet · Published 17 May 2026 · Tags: Other injection, SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .