# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [The Open ISES Project 3.30A SQL Injection via add_facnote.php](https://agentprime.io/advisories/CVE-2018-25404.md) `CVE-2018-25404` · CVE record: Open ISES Open ISES Project · CVSS 8.8 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection - [The Open ISES Project 3.30A SQL Injection via city_graph.php](https://agentprime.io/advisories/CVE-2018-25403.md) `CVE-2018-25403` · CVE record: Open ISES Open ISES Project · CVSS 8.8 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection - [The Open ISES Project 3.30A SQL Injection via inc_types_graph.php](https://agentprime.io/advisories/CVE-2018-25402.md) `CVE-2018-25402` · CVE record: Open ISES Open ISES Project · CVSS 8.8 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection - [The Open ISES Project 3.30A SQL Injection via sever_graph.php](https://agentprime.io/advisories/CVE-2018-25401.md) `CVE-2018-25401` · CVE record: Open ISES Open ISES Project · CVSS 8.8 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection - [The Open ISES Project 3.30A SQL Injection via form_post.php](https://agentprime.io/advisories/CVE-2018-25400.md) `CVE-2018-25400` · CVE record: Open ISES Open ISES Project · CVSS 8.8 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection - [The Open ISES Project 3.30A SQL Injection via nearby.php](https://agentprime.io/advisories/CVE-2018-25399.md) `CVE-2018-25399` · CVE record: Open ISES Open ISES Project · CVSS 8.8 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection - [The Open ISES Project 3.30A SQL Injection via main.php](https://agentprime.io/advisories/CVE-2018-25398.md) `CVE-2018-25398` · CVE record: Open ISES Open ISES Project · CVSS 8.8 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection - [Kados R10 GreenBee SQL Injection via update_feature.php](https://agentprime.io/advisories/CVE-2018-25395.md) `CVE-2018-25395` · CVE record: Kados Kados R10 GreenBee · CVSS 8.8 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection - [Kados R10 GreenBee SQL Injection via update_release.php](https://agentprime.io/advisories/CVE-2018-25394.md) `CVE-2018-25394` · CVE record: Kados Kados R10 GreenBee · CVSS 8.8 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection - [MaxOn ERP Software 8.x-9.x SQL Injection via nomor Parameter](https://agentprime.io/advisories/CVE-2018-25392.md) `CVE-2018-25392` · CVE record: Talagasoft MaxOn ERP · CVSS 7.1 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection - [HaPe PKH 1.1 SQL Injection via desa Parameter](https://agentprime.io/advisories/CVE-2018-25390.md) `CVE-2018-25390` · CVE record: Sitejo HaPe PKH · CVSS 8.8 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection - [HaPe PKH 1.1 SQL Injection via nama_kelompok Parameter](https://agentprime.io/advisories/CVE-2018-25389.md) `CVE-2018-25389` · CVE record: Sitejo HaPe PKH · CVSS 8.8 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection - [HaPe PKH 1.1 SQL Injection via id Parameter in admin/media.php](https://agentprime.io/advisories/CVE-2018-25386.md) `CVE-2018-25386` · CVE record: Sitejo HaPe PKH · CVSS 8.8 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection - [E-Registrasi Pencak Silat 18.10 SQL Injection via id_partai](https://agentprime.io/advisories/CVE-2018-25385.md) `CVE-2018-25385` · CVE record: eregistrasi-kejuaraan-silat Registrasi Pencak Silat · CVSS 8.8 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection - [Zechat 1.5 SQL Injection via uname Parameter](https://agentprime.io/advisories/CVE-2018-25382.md) `CVE-2018-25382` · CVE record: Bylancer Zechat · CVSS 8.8 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection - [FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports](https://agentprime.io/advisories/CVE-2026-44238.md) `CVE-2026-44238` · CVE record: FreePBX security-reporting · CVSS 8.5 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection - [Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter](https://agentprime.io/advisories/CVE-2026-10039.md) `CVE-2026-10039` · CVE record: shabti Frontend Admin by DynamiApps · CVSS 4.9 Medium · Not analysed yet · Published 29 May 2026 · Tags: SQL injection - [Bolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages.](https://agentprime.io/advisories/CVE-2026-39229.md) `CVE-2026-39229` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 29 May 2026 · Tags: SQL injection - [Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save](https://agentprime.io/advisories/GHSA-r2f4-ff2p-xc64.md) `GHSA-r2f4-ff2p-xc64`, `CVE-2026-5394`, `PKSA-vp19-ydt7-tws9` · Packagist `pimcore/pimcore`: affected `<11.5.17 || >=12.0.0-RC1, <12.3.7 || >=2026.1.0, <2026.1.3`, fixed in `11.5.17`, `12.3.7`, `2026.1.3` · CVSS 7.0 High · Not analysed yet · Published 28 May 2026 · Tags: SQL injection - [Photo Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-7048.md) `CVE-2026-7048` · CVE record: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery · CVSS 6.5 Medium · Not analysed yet · Published 28 May 2026 · Tags: SQL injection - [Appointment Booking Calendar <= 1.6.11.8 - Unauthenticated SQL Injection via 'append_where_sql' Parameter](https://agentprime.io/advisories/CVE-2026-7797.md) `CVE-2026-7797` · CVE record: croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin · CVSS 7.5 High · Not analysed yet · Published 28 May 2026 · Tags: SQL injection - [Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix](https://agentprime.io/advisories/GHSA-6qh9-h6wf-jgqc.md) `GHSA-6qh9-h6wf-jgqc`, `CVE-2026-45073`, `PKSA-29h7-kzb3-pdfy`, `PKSA-z7t6-zt6p-wtng` · Packagist `symfony/cache` and 1 more: affected `<5.4.52 || >=6.0.0, <6.4.40 || >=7.0.0, <7.4.12 || >=8.0.0, <8.0.12`, fixed in `5.4.52`, `6.4.40`, `7.4.12`, `8.0.12` · CVSS 6.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Langroid has Prompt to SQL Injection, Leading to RCE](https://agentprime.io/advisories/GHSA-mxfr-6hcw-j9rq.md) `GHSA-mxfr-6hcw-j9rq`, `CVE-2026-25879`, `PYSEC-2026-382` · PyPI `langroid`: affected `<0.63.0`, fixed in `0.63.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: SQL injection, Code injection - [Pi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injection](https://agentprime.io/advisories/CVE-2026-44886.md) `CVE-2026-44886` · CVE record: leiweibau Pi.Alert · CVSS 8.7 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [WordPress Duplicate Page and Post plugin <= 2.9.5 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-49046.md) `CVE-2026-49046` · CVE record: Arjun Thakur Duplicate Page and Post · CVSS 8.5 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [PostgreSQL Anonymizer: malicious column name allows SQL injection via anon.k_anonymity() function](https://agentprime.io/advisories/CVE-2026-9617.md) `CVE-2026-9617` · CVE record: DALIBO PostgreSQL Anonymizer · CVSS 6.8 Medium · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [WordPress Active Products Tables for WooCommerce plugin <= 1.0.9 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42761.md) `CVE-2026-42761` · CVE record: RealMag777 Active Products Tables for WooCommerce · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [WordPress TableOn plugin <= 1.0.5.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42755.md) `CVE-2026-42755` · CVE record: RealMag777 TableOn · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [WordPress Easy Form Builder plugin <= 4.0.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42747.md) `CVE-2026-42747` · CVE record: hassantafreshi Easy Form Builder · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [WordPress Tainacan plugin <= 1.0.3 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42740.md) `CVE-2026-42740` · CVE record: tainacan Tainacan · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [WordPress MasterStudy LMS plugin <= 3.7.29 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42730.md) `CVE-2026-42730` · CVE record: Stylemix MasterStudy LMS · CVSS 8.5 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [WordPress Active Products Tables for WooCommerce plugin <= 1.0.8 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42727.md) `CVE-2026-42727` · CVE record: RealMag777 Active Products Tables for WooCommerce · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [SQL injection in Synology Active Backup for Business](https://agentprime.io/advisories/CVE-2025-30028.md) `CVE-2025-30028` · CVE record: Synology Active Backup for Business · CVSS 8.6 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Unauthenticated SQLi in getAccountData function](https://agentprime.io/advisories/CVE-2026-40850.md) `CVE-2026-40850` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 8.7 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in user_alarmprofile view](https://agentprime.io/advisories/CVE-2026-40849.md) `CVE-2026-40849` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.1 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in tag view](https://agentprime.io/advisories/CVE-2026-40848.md) `CVE-2026-40848` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.1 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in system_tag view](https://agentprime.io/advisories/CVE-2026-40847.md) `CVE-2026-40847` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.1 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in system view](https://agentprime.io/advisories/CVE-2026-40846.md) `CVE-2026-40846` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.1 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in devices_configuration view](https://agentprime.io/advisories/CVE-2026-40845.md) `CVE-2026-40845` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.1 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in dashboard view](https://agentprime.io/advisories/CVE-2026-40844.md) `CVE-2026-40844` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.1 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in alarming view](https://agentprime.io/advisories/CVE-2026-40843.md) `CVE-2026-40843` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.1 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in getWidgetTags function](https://agentprime.io/advisories/CVE-2026-40842.md) `CVE-2026-40842` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.1 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in getProjectTags function](https://agentprime.io/advisories/CVE-2026-40841.md) `CVE-2026-40841` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.1 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in VerifyCreateLicences function](https://agentprime.io/advisories/CVE-2026-40840.md) `CVE-2026-40840` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.1 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in getComponentScalings function](https://agentprime.io/advisories/CVE-2026-40839.md) `CVE-2026-40839` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.1 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in getDeviceScalings function](https://agentprime.io/advisories/CVE-2026-40838.md) `CVE-2026-40838` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.1 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in getProjectScalings function](https://agentprime.io/advisories/CVE-2026-40837.md) `CVE-2026-40837` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.1 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in inmessage model](https://agentprime.io/advisories/CVE-2026-40836.md) `CVE-2026-40836` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.1 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in saveObjectFromData function](https://agentprime.io/advisories/CVE-2026-40835.md) `CVE-2026-40835` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.1 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in saveDashboardLayout function](https://agentprime.io/advisories/CVE-2026-40834.md) `CVE-2026-40834` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.1 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in saveDashboardLayout function](https://agentprime.io/advisories/CVE-2026-40833.md) `CVE-2026-40833` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.1 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Unauthenticated SQL Injection in dotCMS Publish Audit API](https://agentprime.io/advisories/CVE-2026-8054.md) `CVE-2026-8054` · CVE record: dotCMS dotCMS Core · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in getDevicegroups function](https://agentprime.io/advisories/CVE-2026-40832.md) `CVE-2026-40832` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.1 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in Easy View](https://agentprime.io/advisories/CVE-2026-40831.md) `CVE-2026-40831` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.1 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in UpdateParam function](https://agentprime.io/advisories/CVE-2026-40830.md) `CVE-2026-40830` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.0 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in UpdateParam function](https://agentprime.io/advisories/CVE-2026-40829.md) `CVE-2026-40829` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.0 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in DeleteSysLogEntry function](https://agentprime.io/advisories/CVE-2026-40828.md) `CVE-2026-40828` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.0 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in \_RemoveRequest function](https://agentprime.io/advisories/CVE-2026-40827.md) `CVE-2026-40827` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.0 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in dsgvo_contracts view](https://agentprime.io/advisories/CVE-2026-40826.md) `CVE-2026-40826` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 6.9 Medium · Not analysed yet · Published 27 May 2026 · Tags: SQL injection - [Authenticated SQLi in accountstatus view](https://agentprime.io/advisories/CVE-2026-40825.md) `CVE-2026-40825` · CVE record: MB connect line mbCONNECT24 and 3 more · CVSS 7.0 High · Not analysed yet · Published 27 May 2026 · Tags: SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .