# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Authenticated SQLi in accountstatus view](https://agentprime.io/advisories/CVE-2026-40824.md) `CVE-2026-40824` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.0 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in DevSerialReset function](https://agentprime.io/advisories/CVE-2026-40823.md) `CVE-2026-40823` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.0 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in DevSerialReset function](https://agentprime.io/advisories/CVE-2026-40822.md) `CVE-2026-40822` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 6.9 Medium · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in getAccountByID function](https://agentprime.io/advisories/CVE-2026-40821.md) `CVE-2026-40821` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 6.9 Medium · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Unauthenticated SQLi in sync_data24 task](https://agentprime.io/advisories/CVE-2026-40819.md) `CVE-2026-40819` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 8.7 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Unauthenticated SQLi in \_mb24confi_getDevice function function](https://agentprime.io/advisories/CVE-2026-40818.md) `CVE-2026-40818` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 8.7 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Unauthenticated SQLi in getAlarmProfiles function](https://agentprime.io/advisories/CVE-2026-40817.md) `CVE-2026-40817` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 8.7 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Unauthenticated SQLi in \_mb24confi_getTagAlarm function](https://agentprime.io/advisories/CVE-2026-40816.md) `CVE-2026-40816` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 8.7 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Unauthenticated SQLi in \_mb24api_getUserAccount function](https://agentprime.io/advisories/CVE-2026-40815.md) `CVE-2026-40815` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 8.7 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Unauthenticated SQLi in \_mb24confi_getTagAlarm function](https://agentprime.io/advisories/CVE-2026-40814.md) `CVE-2026-40814` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 8.7 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Unauthenticated SQLi in getLiveValues](https://agentprime.io/advisories/CVE-2026-40813.md) `CVE-2026-40813` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 8.7 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Unauthenticated SQLi in getLiveValues function](https://agentprime.io/advisories/CVE-2026-40812.md) `CVE-2026-40812` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 8.7 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Unauthenticated SQLi in ssoabstractservice](https://agentprime.io/advisories/CVE-2026-40811.md) `CVE-2026-40811` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 8.7 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Unauthenticated SQLi in userinfo Endpoint](https://agentprime.io/advisories/CVE-2026-40810.md) `CVE-2026-40810` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 8.7 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [EnvíaloSimple: Email Marketing y Newsletters <= 2.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter](https://agentprime.io/advisories/CVE-2026-7618.md) `CVE-2026-7618` · CVE record: dattateccom EnvíaloSimple: Email Marketing y Newsletters · CVSS 4.9 Medium · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter](https://agentprime.io/advisories/GHSA-h4ph-crvj-9h92.md) `GHSA-h4ph-crvj-9h92`, `CVE-2026-44741`, `PKSA-v29g-sqpm-mznn` · Packagist `pimcore/admin-ui-classic-bundle`: affected `<1.7.18 || >=2.0.0-RC1, <2.3.6`, fixed in `1.7.18`, `2.3.6` · CVSS 8.8 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration](https://agentprime.io/advisories/GHSA-3234-gxc3-pq6f.md) `GHSA-3234-gxc3-pq6f`, `CVE-2026-44739`, `PKSA-kp19-xmdp-rvyj` · Packagist `pimcore/pimcore`: affected `<11.5.17 || >=12.0.0-RC1, <12.3.6 || >=2026.1.0, <2026.1.2`, fixed in `11.5.17`, `12.3.6`, `2026.1.2` · CVSS 8.7 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [itsourcecode Courier Management System parcel_list.php sql injection](https://agentprime.io/advisories/CVE-2026-9607.md) `CVE-2026-9607` · CVE record: itsourcecode Courier Management System · CVSS 5.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Other injection, SQL injection - [OpenRapid RapidCMS v1.3.1 was discovered to contain an authentication bypass in the /template/default/menu.php component.](https://agentprime.io/advisories/CVE-2026-38930.md) `CVE-2026-38930` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components](https://agentprime.io/advisories/CVE-2026-38808.md) `CVE-2026-38808` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [itsourcecode Courier Management System manage_user.php sql injection](https://agentprime.io/advisories/CVE-2026-9606.md) `CVE-2026-9606` · CVE record: itsourcecode Courier Management System · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [code-projects Project Management System Login chk.php sql injection](https://agentprime.io/advisories/CVE-2026-9584.md) `CVE-2026-9584` · CVE record: code-projects Project Management System · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [itsourcecode Student Transcript Processing System index.php sql injection](https://agentprime.io/advisories/CVE-2026-9575.md) `CVE-2026-9575` · CVE record: itsourcecode Student Transcript Processing System · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [itsourcecode Student Transcript Processing System trans.php sql injection](https://agentprime.io/advisories/CVE-2026-9574.md) `CVE-2026-9574` · CVE record: itsourcecode Student Transcript Processing System · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [itsourcecode Student Transcript Processing System index.php sql injection](https://agentprime.io/advisories/CVE-2026-9573.md) `CVE-2026-9573` · CVE record: itsourcecode Student Transcript Processing System · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [Chatwoot: SQL Injection in Conversation/Contact Filter API via Custom Attribute Values](https://agentprime.io/advisories/CVE-2026-44706.md) `CVE-2026-44706` · CVE record: chatwoot chatwoot · CVSS 8.5 High · Not analysed yet · Published 26 May 2026 · Tags: SQL injection - [Twenty: SQL Injection via the timeZone field](https://agentprime.io/advisories/CVE-2026-46624.md) `CVE-2026-46624` · CVE record: twentyhq twenty · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 May 2026 · Tags: Command injection, SQL injection - [Joomla! Core - \[20260506\] - Authenticated blind SQLi in com_finder](https://agentprime.io/advisories/CVE-2026-35221.md) `CVE-2026-35221` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: SQL injection - [Joomla! Core - \[20260507\] - Authenticated blind SQLi in com_tags](https://agentprime.io/advisories/CVE-2026-35222.md) `CVE-2026-35222` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: SQL injection - [Vulnerabilities exists in IBM Cloud Pak for Data System (CPDS 1.0) - Cyclops.](https://agentprime.io/advisories/CVE-2025-36220.md) `CVE-2025-36220` · CVE record: IBM Cloud Pak for Data System - Cyclops · CVSS 4.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: SQL injection - [OpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQuery](https://agentprime.io/advisories/CVE-2026-42425.md) `CVE-2026-42425` · CVE record: Openkm OpenKM Community Edition and 1 more · CVSS 8.6 High · Not analysed yet · Published 26 May 2026 · Tags: SQL injection - [Das Parking Management System 停车场管理系统 Search API Endpoint sql injection](https://agentprime.io/advisories/CVE-2026-9552.md) `CVE-2026-9552` · CVE record: Das Parking Management System 停车场管理系统 · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [Das Parking Management System 停车场管理系统 API Endpoint ExportParkingRecords xp_cmdshell sql injection](https://agentprime.io/advisories/CVE-2026-9551.md) `CVE-2026-9551` · CVE record: Das Parking Management System 停车场管理系统 · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [Authenticated Administrator Role-Based Access Control Bypass in Compliance](https://agentprime.io/advisories/CVE-2026-48136.md) `CVE-2026-48136` · CVE record: checkpoint Quantum Security Management · CVSS 4.1 Medium · Not analysed yet · Published 26 May 2026 · Tags: SQL injection - [SQL injection issue in UserCheck Portal when DLP Software Blade is active](https://agentprime.io/advisories/CVE-2026-48134.md) `CVE-2026-48134` · CVE record: checkpoint Quantum Security Gateway · CVSS 5.6 Medium · Not analysed yet · Published 26 May 2026 · Tags: SQL injection - [Shenzhen Sixun Software Sixun Shanghui Group Business Management System PayConfig sql injection](https://agentprime.io/advisories/CVE-2026-9544.md) `CVE-2026-9544` · CVE record: Shenzhen Sixun Software Sixun Shanghui Group Business Management System · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [CodeAstro Leave Management System add_staff.php sql injection](https://agentprime.io/advisories/CVE-2026-9542.md) `CVE-2026-9542` · CVE record: CodeAstro Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [itsourcecode Electronic Judging System delete_judge.php sql injection](https://agentprime.io/advisories/CVE-2026-9528.md) `CVE-2026-9528` · CVE record: itsourcecode Electronic Judging System · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [itsourcecode Electronic Judging System edit_team.php sql injection](https://agentprime.io/advisories/CVE-2026-9526.md) `CVE-2026-9526` · CVE record: itsourcecode Electronic Judging System · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [itsourcecode Electronic Judging System edit_judge.php sql injection](https://agentprime.io/advisories/CVE-2026-9525.md) `CVE-2026-9525` · CVE record: itsourcecode Electronic Judging System · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [xianrendzw EasyReport REST Endpoint execute sql injection](https://agentprime.io/advisories/CVE-2026-9524.md) `CVE-2026-9524` · CVE record: xianrendzw EasyReport · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform getCalcmeterDetailDayListTree sql injection](https://agentprime.io/advisories/CVE-2026-9523.md) `CVE-2026-9523` · CVE record: Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, SQL injection - [WordPress eMagicOne Store Manager plugin <= 1.3.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42773.md) `CVE-2026-42773` · CVE record: eMagicOne eMagicOne Store Manager · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 May 2026 · Tags: SQL injection - [WordPress JetEngine plugin <= 3.8.8.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42774.md) `CVE-2026-42774` · CVE record: Crocoblock JetEngine · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 May 2026 · Tags: SQL injection - [WordPress Unlimited Elements For Elementor plugin <= 2.0.8 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-48837.md) `CVE-2026-48837` · CVE record: Unlimited Elements Unlimited Elements For Elementor · CVSS 8.5 High · Not analysed yet · Published 25 May 2026 · Tags: SQL injection - [SQL injection in Roundcube Webmail](https://agentprime.io/advisories/CVE-2026-48842.md) `CVE-2026-48842` · CVE record: Roundcube Webmail · CVSS 8.1 High · Not analysed yet · Published 25 May 2026 · Tags: SQL injection - [yashpokharna2555 StudentManagementSystem studentdel.php confirm_logged_in sql injection](https://agentprime.io/advisories/CVE-2026-9474.md) `CVE-2026-9474` · CVE record: yashpokharna2555 StudentManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection - [SQL injection in Genetec Inc. Genetec Security Center](https://agentprime.io/advisories/CVE-2026-27768.md) `CVE-2026-27768` · CVE record: Genetec Inc. Genetec Security Center · CVSS 6.6 Medium · Not analysed yet · Published 25 May 2026 · Tags: SQL injection - [yashpokharna2555 StudentManagementSystem student_trans.php confirm_logged_in sql injection](https://agentprime.io/advisories/CVE-2026-9470.md) `CVE-2026-9470` · CVE record: yashpokharna2555 StudentManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection - [yashpokharna2555 StudentManagementSystem success.php sql injection](https://agentprime.io/advisories/CVE-2026-9469.md) `CVE-2026-9469` · CVE record: yashpokharna2555 StudentManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection - [Tiandy Easy7 Integrated Management Platform GetDBDataEx.jsp sql injection](https://agentprime.io/advisories/CVE-2026-9465.md) `CVE-2026-9465` · CVE record: Tiandy Easy7 Integrated Management Platform · CVSS 6.9 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection - [Joomla Responsive Portfolio 1.6.1 SQL Injection via filter parameters](https://agentprime.io/advisories/CVE-2018-25381.md) `CVE-2018-25381` · CVE record: Extro Responsive Portfolio · CVSS 7.1 High · Not analysed yet · Published 25 May 2026 · Tags: SQL injection - [Joomla Component eXtroForms 2.1.5 SQL Injection via filter parameters](https://agentprime.io/advisories/CVE-2018-25380.md) `CVE-2018-25380` · CVE record: Extro eXtroForms · CVSS 7.1 High · Not analysed yet · Published 25 May 2026 · Tags: SQL injection - [Collectric CMU 1.0 SQL Injection via lang Parameter](https://agentprime.io/advisories/CVE-2018-25379.md) `CVE-2018-25379` · CVE record: Ourenergy Collectric CMU · CVSS 8.8 High · Not analysed yet · Published 25 May 2026 · Tags: SQL injection - [MedDream PACS Server Premium 6.7.1.1 SQL Injection via email](https://agentprime.io/advisories/CVE-2018-25372.md) `CVE-2018-25372` · CVE record: MedDream PACS Server Premium · CVSS 8.8 High · Not analysed yet · Published 25 May 2026 · Tags: SQL injection - [mooSocial Store Plugin 2.6 SQL Injection via product parameter](https://agentprime.io/advisories/CVE-2018-25371.md) `CVE-2018-25371` · CVE record: Moosocial mooSocial Store Plugin · CVSS 8.8 High · Not analysed yet · Published 25 May 2026 · Tags: SQL injection - [Twitter-Clone 1 SQL Injection via search.php](https://agentprime.io/advisories/CVE-2018-25364.md) `CVE-2018-25364` · CVE record: Fyffe PHP-Twitter-Clone · CVSS 8.8 High · Not analysed yet · Published 25 May 2026 · Tags: SQL injection - [Twitter-Clone 1 SQL Injection via follow.php](https://agentprime.io/advisories/CVE-2018-25362.md) `CVE-2018-25362` · CVE record: Fyffe PHP-Twitter-Clone · CVSS 8.8 High · Not analysed yet · Published 25 May 2026 · Tags: SQL injection - [code-projects Employee Management System applyleaveprocess.php sql injection](https://agentprime.io/advisories/CVE-2026-9451.md) `CVE-2026-9451` · CVE record: code-projects Employee Management System · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection - [code-projects Employee Management System psubmit.php sql injection](https://agentprime.io/advisories/CVE-2026-9450.md) `CVE-2026-9450` · CVE record: code-projects Employee Management System · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .