# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [SourceCodester Class and Exam Timetabling System archive5.php sql injection](https://agentprime.io/advisories/CVE-2026-11482.md) `CVE-2026-11482` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection - [Chengdu Everbrite Network Technology BeikeShop Admin Design Builder Endpoint admin.php sql injection](https://agentprime.io/advisories/CVE-2026-11480.md) `CVE-2026-11480` · CVE record: Chengdu Everbrite Network Technology BeikeShop · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection - [Kushan2k student-management-system Certificate Verification Endpoint GradeController.php getStatus sql injection](https://agentprime.io/advisories/CVE-2026-11475.md) `CVE-2026-11475` · CVE record: Kushan2k student-management-system · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection - [jflyfox jfinal_cms AdvicefeedbackController.java list sql injection](https://agentprime.io/advisories/CVE-2026-11473.md) `CVE-2026-11473` · CVE record: jflyfox jfinal_cms · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection - [SourceCodester Class and Exam Timetabling System index1.php sql injection](https://agentprime.io/advisories/CVE-2026-11472.md) `CVE-2026-11472` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection - [SourceCodester Class and Exam Timetabling System index2.php sql injection](https://agentprime.io/advisories/CVE-2026-11471.md) `CVE-2026-11471` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection - [Chanjet CRM HTTP GET Request jxf_dump_systable.php sql injection](https://agentprime.io/advisories/CVE-2026-11456.md) `CVE-2026-11456` · CVE record: Chanjet CRM · CVSS 6.9 Medium · Not analysed yet · Published 7 Jun 2026 · Tags: Other injection, SQL injection - [Tiobon Employee Self-Service System Login Endpoint BlogSearch.aspx sql injection](https://agentprime.io/advisories/CVE-2026-11453.md) `CVE-2026-11453` · CVE record: Tiobon Employee Self-Service System · CVSS 5.3 Medium · Not analysed yet · Published 7 Jun 2026 · Tags: Other injection, SQL injection - [Jinher OA nextselectplan.aspx sql injection](https://agentprime.io/advisories/CVE-2026-11435.md) `CVE-2026-11435` · CVE record: Jinher OA · CVSS 6.9 Medium · Not analysed yet · Published 6 Jun 2026 · Tags: Other injection, SQL injection - [Jinher OA GetFormSn.aspx sql injection](https://agentprime.io/advisories/CVE-2026-11412.md) `CVE-2026-11412` · CVE record: Jinher OA · CVSS 5.3 Medium · Not analysed yet · Published 6 Jun 2026 · Tags: Other injection, SQL injection - [Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter](https://agentprime.io/advisories/CVE-2026-9829.md) `CVE-2026-9829` · CVE record: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery · CVSS 6.5 Medium · Not analysed yet · Published 6 Jun 2026 · Tags: SQL injection - [OptinCraft <= 1.2.0 - Authenticated (Administrator+) SQL Injection via 'order_by' Parameter](https://agentprime.io/advisories/CVE-2026-8978.md) `CVE-2026-8978` · CVE record: crafium OptinCraft – Drag & Drop Optins & Popup Builder for WordPress · CVSS 4.9 Medium · Not analysed yet · Published 6 Jun 2026 · Tags: SQL injection - [Quiz and Survey Master (QSM) <= 11.1.2 - Authenticated (Admin+) SQL Injection via 'order' and 'limit' Parameters](https://agentprime.io/advisories/CVE-2026-6448.md) `CVE-2026-6448` · CVE record: expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker · CVSS 4.9 Medium · Not analysed yet · Published 5 Jun 2026 · Tags: SQL injection - [Open XDMoD Vulnerable to Unauthenticated SQL Injection Leading to Full Database Compromise](https://agentprime.io/advisories/CVE-2026-45779.md) `CVE-2026-45779` · CVE record: ubccr xdmod · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Jun 2026 · Tags: SQL injection - [code-projects Hotel and Tourism Reservation System details.php sql injection](https://agentprime.io/advisories/CVE-2026-11342.md) `CVE-2026-11342` · CVE record: code-projects Hotel and Tourism Reservation System · CVSS 6.9 Medium · Not analysed yet · Published 5 Jun 2026 · Tags: Other injection, SQL injection - [NocoDB: SQL Injection via Column Title in Bulk GroupBy](https://agentprime.io/advisories/GHSA-p8wx-5f39-w3x4.md) `GHSA-p8wx-5f39-w3x4`, `CVE-2026-47384` · npm `nocodb`: affected `<2026.05.1`, fixed in `2026.05.1` · CVSS 5.3 Medium · Not analysed yet · Published 5 Jun 2026 · Tags: SQL injection - [NocoDB: Postgres SQL Injection in Formula \`ARRAYSORT\`](https://agentprime.io/advisories/GHSA-cxv7-gmmp-228p.md) `GHSA-cxv7-gmmp-228p`, `CVE-2026-47375` · npm `nocodb`: affected `<2026.04.1`, fixed in `2026.04.1` · CVSS 6.0 Medium · Not analysed yet · Published 5 Jun 2026 · Tags: SQL injection - [tittuvarghese CollegeManagementSystem fetch.php sql injection](https://agentprime.io/advisories/CVE-2026-11334.md) `CVE-2026-11334` · CVE record: tittuvarghese CollegeManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 5 Jun 2026 · Tags: Other injection, SQL injection - [SourceCodester Ship Ferry Ticket Reservation System Admin Login login.php sql injection](https://agentprime.io/advisories/CVE-2026-10877.md) `CVE-2026-10877` · CVE record: SourceCodester Ship Ferry Ticket Reservation System · CVSS 6.9 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Other injection, SQL injection - [projectworlds Online Art Gallery Shop Project adminHome.ph sql injection](https://agentprime.io/advisories/CVE-2026-10875.md) `CVE-2026-10875` · CVE record: projectworlds Online Art Gallery Shop Project · CVSS 5.3 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Other injection, SQL injection - [projectworlds Online Art Gallery Shop Project adminHome.php sql injection](https://agentprime.io/advisories/CVE-2026-10874.md) `CVE-2026-10874` · CVE record: projectworlds Online Art Gallery Shop Project · CVSS 5.3 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Other injection, SQL injection - [OpenMeter: SQL injection through meter creation](https://agentprime.io/advisories/GHSA-wc3v-3457-c8cm.md) `GHSA-wc3v-3457-c8cm`, `CVE-2026-8462`, `GO-2026-5703` · Go `github.com/openmeterio/openmeter`: affected `<1.0.0-beta.228`, fixed in `1.0.0-beta.228` · CVSS 8.9 High · Not analysed yet · Published 4 Jun 2026 · Tags: SQL injection - [Unauthenticated SQL Injection in Osnexus Quantastor](https://agentprime.io/advisories/CVE-2026-10880.md) `CVE-2026-10880` · CVE record: Osnexus QuantaStor · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Jun 2026 · Tags: SQL injection - [itsourcecode Fees Management System receipt.php sql injection](https://agentprime.io/advisories/CVE-2026-10811.md) `CVE-2026-10811` · CVE record: itsourcecode Fees Management System · CVSS 5.3 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Other injection, SQL injection - [WordPress Plugin Google Review Slider 6.1 SQL Injection via tid](https://agentprime.io/advisories/CVE-2019-25745.md) `CVE-2019-25745` · CVE record: jgwhite33 Google Review Slider · CVSS 8.8 High · Not analysed yet · Published 4 Jun 2026 · Tags: SQL injection - [PHP EI-Tube Script 3 SQL Injection via search parameter](https://agentprime.io/advisories/CVE-2019-25732.md) `CVE-2019-25732` · CVE record: eitube EI-Tube · CVSS 8.8 High · Not analysed yet · Published 4 Jun 2026 · Tags: SQL injection - [Listing Hub CMS 1.0 SQL Injection via pages.php id](https://agentprime.io/advisories/CVE-2019-25730.md) `CVE-2019-25730` · CVE record: Themerig Listing Hub CMS · CVSS 8.8 High · Not analysed yet · Published 4 Jun 2026 · Tags: SQL injection - [Care2x 2.7 Hospital Information System SQL Injection via ck_config](https://agentprime.io/advisories/CVE-2019-25728.md) `CVE-2019-25728` · CVE record: care2x Care2x · CVSS 8.8 High · Not analysed yet · Published 4 Jun 2026 · Tags: SQL injection - [All in One Video Downloader 1.2 SQL Injection via admin page-edit](https://agentprime.io/advisories/CVE-2019-25726.md) `CVE-2019-25726` · CVE record: Nicheoffice All in One Video Downloader · CVSS 8.8 High · Not analysed yet · Published 4 Jun 2026 · Tags: SQL injection - [itsourcecode Fees Management System manage_user.php sql injection](https://agentprime.io/advisories/CVE-2026-10809.md) `CVE-2026-10809` · CVE record: itsourcecode Fees Management System · CVSS 5.3 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Other injection, SQL injection - [itsourcecode Fees Management System manage_student.php sql injection](https://agentprime.io/advisories/CVE-2026-10808.md) `CVE-2026-10808` · CVE record: itsourcecode Fees Management System · CVSS 5.3 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Other injection, SQL injection - [SQLi in Akmer Informatics' TeknoPass](https://agentprime.io/advisories/CVE-2026-4104.md) `CVE-2026-4104` · CVE record: Akmer Informatics Automation Industry and Trade Ltd. Co. TeknoPass · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Jun 2026 · Tags: SQL injection - [WordPress Photo Gallery by 10Web plugin <= 1.8.41 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-49771.md) `CVE-2026-49771` · CVE record: 10Web Photo Gallery by 10Web · CVSS 7.6 High · Not analysed yet · Published 4 Jun 2026 · Tags: SQL injection - [MasterStudy LMS Pro Plus <= 4.8.20 - Authenticated (Instructor+) SQL Injection via 'columns' Parameter](https://agentprime.io/advisories/CVE-2026-8653.md) `CVE-2026-8653` · CVE record: StylemixThemes MasterStudy LMS Pro · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: SQL injection - [WordPress School Management plugin <= 93.2.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2025-15655.md) `CVE-2025-15655` · CVE record: Mojoomla School Management · CVSS 7.6 High · Not analysed yet · Published 3 Jun 2026 · Tags: SQL injection - [SourceCodester Pizzafy E-Commerce System Administrative Control Panel admin_class_novo.php login sql injection](https://agentprime.io/advisories/CVE-2026-10704.md) `CVE-2026-10704` · CVE record: SourceCodester Pizzafy E-Commerce System · CVSS 6.9 Medium · Not analysed yet · Published 3 Jun 2026 · Tags: Other injection, SQL injection - [code-projects Student Admission System index.php sql injection](https://agentprime.io/advisories/CVE-2026-10620.md) `CVE-2026-10620` · CVE record: code-projects Student Admission System · CVSS 6.9 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Other injection, SQL injection - [ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection via 'order' Parameter](https://agentprime.io/advisories/CVE-2026-5073.md) `CVE-2026-5073` · CVE record: armember ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup · CVSS 7.5 High · Not analysed yet · Published 2 Jun 2026 · Tags: SQL injection - [ARMember Premium <= 7.3.1 - Authenticated (Subscriber+) SQL Injection via 'sSortDir_0' Parameter](https://agentprime.io/advisories/CVE-2026-5074.md) `CVE-2026-5074` · CVE record: armember ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup · CVSS 6.5 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: SQL injection - [DedeCMS carbuyaction.php RemoveXSS sql injection](https://agentprime.io/advisories/CVE-2026-10608.md) `CVE-2026-10608` · CVE record: DedeCMS · CVSS 6.9 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Other injection, SQL injection - [DedeCMS flink.php dede_htmlspecialchars sql injection](https://agentprime.io/advisories/CVE-2026-10607.md) `CVE-2026-10607` · CVE record: DedeCMS · CVSS 6.9 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Other injection, SQL injection - [DedeCMS Feedback feedback.php TrimMsg sql injection](https://agentprime.io/advisories/CVE-2026-10606.md) `CVE-2026-10606` · CVE record: DedeCMS · CVSS 6.9 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Other injection, SQL injection - [WordPress WP Job Portal plugin <= 2.5.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42684.md) `CVE-2026-42684` · CVE record: Ahmad WP Job Portal · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jun 2026 · Tags: SQL injection - [itsourcecode Fees Management System manage_payment.php sql injection](https://agentprime.io/advisories/CVE-2026-10568.md) `CVE-2026-10568` · CVE record: itsourcecode Fees Management System · CVSS 5.3 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Other injection, SQL injection - [itsourcecode Fees Management System manage_fee.php sql injection](https://agentprime.io/advisories/CVE-2026-10302.md) `CVE-2026-10302` · CVE record: itsourcecode Fees Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [itsourcecode Fees Management System manage_course.php sql injection](https://agentprime.io/advisories/CVE-2026-10297.md) `CVE-2026-10297` · CVE record: itsourcecode Fees Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [Kiteworks Secure Data Forms has a SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-24782.md) `CVE-2026-24782` · CVE record: kiteworks Secure Data Forms · CVSS 7.6 High · Not analysed yet · Published 1 Jun 2026 · Tags: SQL injection - [itsourcecode Fees Management System ajax.php sql injection](https://agentprime.io/advisories/CVE-2026-10296.md) `CVE-2026-10296` · CVE record: itsourcecode Fees Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [SQL injection in Google Android](https://agentprime.io/advisories/CVE-2026-0075.md) `CVE-2026-0075` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 1 Jun 2026 · Tags: SQL injection - [Pixa Bank 2.0 SQL Injection via agence-ajax.php API](https://agentprime.io/advisories/CVE-2026-49491.md) `CVE-2026-49491` · CVE record: Pixastudio Pixa Bank · CVSS 8.8 High · Not analysed yet · Published 1 Jun 2026 · Tags: SQL injection - [WP AutoSuggest 0.24 SQL Injection via autosuggest.php](https://agentprime.io/advisories/CVE-2018-25434.md) `CVE-2018-25434` · CVE record: eliekhoury WP AutoSuggest · CVSS 8.8 High · Not analysed yet · Published 1 Jun 2026 · Tags: SQL injection - [Joomla JE Photo Gallery 1.1 SQL Injection via categoryid](https://agentprime.io/advisories/CVE-2018-25433.md) `CVE-2018-25433` · CVE record: Joomlaextensions JE Photo Gallery · CVSS 8.8 High · Not analysed yet · Published 1 Jun 2026 · Tags: SQL injection - [No-Cms 1.0 SQL Injection via order_by Parameter](https://agentprime.io/advisories/CVE-2018-25431.md) `CVE-2018-25431` · CVE record: goFrendiAsgard No-CMS · CVSS 7.1 High · Not analysed yet · Published 1 Jun 2026 · Tags: SQL injection - [Paroiciel 11.20 SQL Injection via eGeqIdEquipe Parameter](https://agentprime.io/advisories/CVE-2018-25430.md) `CVE-2018-25430` · CVE record: Paroiciel Paroiciel · CVSS 7.1 High · Not analysed yet · Published 1 Jun 2026 · Tags: SQL injection - [Paroiciel 11.20 SQL Injection via zProIdPro Parameter](https://agentprime.io/advisories/CVE-2018-25429.md) `CVE-2018-25429` · CVE record: Paroiciel Paroiciel · CVSS 7.1 High · Not analysed yet · Published 1 Jun 2026 · Tags: SQL injection - [Paroiciel 11.20 SQL Injection via tRecIdListe Parameter](https://agentprime.io/advisories/CVE-2018-25428.md) `CVE-2018-25428` · CVE record: Paroiciel Paroiciel · CVSS 8.8 High · Not analysed yet · Published 1 Jun 2026 · Tags: SQL injection - [code-projects Hotel and Tourism Reservation System GET Parameter tour.php sql injection](https://agentprime.io/advisories/CVE-2026-10290.md) `CVE-2026-10290` · CVE record: code-projects Hotel and Tourism Reservation System · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [CodeAstro Payroll System home_employee.php sql injection](https://agentprime.io/advisories/CVE-2026-10286.md) `CVE-2026-10286` · CVE record: CodeAstro Payroll System · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views](https://agentprime.io/advisories/CVE-2026-45722.md) `CVE-2026-45722` · CVE record: nextcloud security-advisories · CVSS 7.1 High · Not analysed yet · Published 1 Jun 2026 · Tags: SQL injection - [Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution](https://agentprime.io/advisories/CVE-2026-45545.md) `CVE-2026-45545` · CVE record: nextcloud security-advisories · CVSS 8.2 High · Not analysed yet · Published 1 Jun 2026 · Tags: SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .