# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [WordPress WP Directory Kit plugin <= 1.5.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42672.md) `CVE-2026-42672` · CVE record: Wp Directory Kit WP Directory Kit · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jun 2026 · Tags: SQL injection - [itsourcecode Content Management System edit_topic.php sql injection](https://agentprime.io/advisories/CVE-2026-10265.md) `CVE-2026-10265` · CVE record: itsourcecode Content Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [SourceCodester Computer Repair Shop Management System manage_product.php sql injection](https://agentprime.io/advisories/CVE-2026-10263.md) `CVE-2026-10263` · CVE record: SourceCodester Computer Repair Shop Management System · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [code-projects Real State Services Login loginuser.php sql injection](https://agentprime.io/advisories/CVE-2026-10262.md) `CVE-2026-10262` · CVE record: code-projects Real State Services · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [CodeAstro Online Job Portal application_status.php sql injection](https://agentprime.io/advisories/CVE-2026-10261.md) `CVE-2026-10261` · CVE record: CodeAstro Online Job Portal · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [CodeAstro Online Job Portal delete-jobs.php sql injection](https://agentprime.io/advisories/CVE-2026-10260.md) `CVE-2026-10260` · CVE record: CodeAstro Online Job Portal · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [itsourcecode Content Management System add_sub_topic.php sql injection](https://agentprime.io/advisories/CVE-2026-10258.md) `CVE-2026-10258` · CVE record: itsourcecode Content Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [itsourcecode Content Management System update_ss_img.php sql injection](https://agentprime.io/advisories/CVE-2026-10257.md) `CVE-2026-10257` · CVE record: itsourcecode Content Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [itsourcecode Content Management System save_comment.php sql injection](https://agentprime.io/advisories/CVE-2026-10256.md) `CVE-2026-10256` · CVE record: itsourcecode Content Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [itsourcecode Online House Rental System manage_payment.php sql injection](https://agentprime.io/advisories/CVE-2026-10253.md) `CVE-2026-10253` · CVE record: itsourcecode Online House Rental System · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [itsourcecode Online House Rental System manage_tenant.php sql injection](https://agentprime.io/advisories/CVE-2026-10252.md) `CVE-2026-10252` · CVE record: itsourcecode Online House Rental System · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [itsourcecode Online House Rental System ajax.php login sql injection](https://agentprime.io/advisories/CVE-2026-10251.md) `CVE-2026-10251` · CVE record: itsourcecode Online House Rental System · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Blood Bank Management System campsdetails.php sql injection](https://agentprime.io/advisories/CVE-2026-10250.md) `CVE-2026-10250` · CVE record: itsourcecode Online Blood Bank Management System · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Blood Bank Management System viewrequest.php sql injection](https://agentprime.io/advisories/CVE-2026-10249.md) `CVE-2026-10249` · CVE record: itsourcecode Online Blood Bank Management System · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [Multiple SQL Injections in SOPlanning](https://agentprime.io/advisories/CVE-2026-40546.md) `CVE-2026-40546` · CVE record: SOPlanning SOPlanning · CVSS 8.7 High · Not analysed yet · Published 1 Jun 2026 · Tags: SQL injection - [itsourcecode Content Management System instructions.php sql injection](https://agentprime.io/advisories/CVE-2026-10242.md) `CVE-2026-10242` · CVE record: itsourcecode Content Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [SourceCodester Water Billing Management System User Management manage_user sql injection](https://agentprime.io/advisories/CVE-2026-10237.md) `CVE-2026-10237` · CVE record: SourceCodester Water Billing Management System · CVSS 5.1 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [CodeAstro Ingredients Stock Management System stock_manager.php sql injection](https://agentprime.io/advisories/CVE-2026-10235.md) `CVE-2026-10235` · CVE record: CodeAstro Ingredients Stock Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [raisulislamg4 student_management_system_by_php User Creation add_user_check.php sql injection](https://agentprime.io/advisories/CVE-2026-10227.md) `CVE-2026-10227` · CVE record: raisulislamg4 student_management_system_by_php · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [raisulislamg4 student_management_system_by_php delete.php sql injection](https://agentprime.io/advisories/CVE-2026-10226.md) `CVE-2026-10226` · CVE record: raisulislamg4 student_management_system_by_php · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [raisulislamg4 student_management_system_by_php Login login_check.php sql injection](https://agentprime.io/advisories/CVE-2026-10225.md) `CVE-2026-10225` · CVE record: raisulislamg4 student_management_system_by_php · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [code-projects Online Hospital Management System Appointment appointmentdetail.php sql injection](https://agentprime.io/advisories/CVE-2026-10209.md) `CVE-2026-10209` · CVE record: code-projects Online Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [code-projects Online Hospital Management System login_1.php login_user sql injection](https://agentprime.io/advisories/CVE-2026-10208.md) `CVE-2026-10208` · CVE record: code-projects Online Hospital Management System · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Other injection, SQL injection - [OFCMS JSON Query SysUserController.java query sql injection](https://agentprime.io/advisories/CVE-2026-10204.md) `CVE-2026-10204` · CVE record: OFCMS · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [OFCMS JSON Query SystemParamController.java query sql injection](https://agentprime.io/advisories/CVE-2026-10203.md) `CVE-2026-10203` · CVE record: OFCMS · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [OFCMS JSON Query SystemDictController.java query sql injection](https://agentprime.io/advisories/CVE-2026-10202.md) `CVE-2026-10202` · CVE record: OFCMS · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [OFCMS ComnController ComnController.java query sql injection](https://agentprime.io/advisories/CVE-2026-10193.md) `CVE-2026-10193` · CVE record: OFCMS · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [code-projects Online Hospital Management System patient.php sql injection](https://agentprime.io/advisories/CVE-2026-10186.md) `CVE-2026-10186` · CVE record: code-projects Online Hospital Management System · CVSS 6.9 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [SourceCodester Hospitals Patient Records Management System Users.php save sql injection](https://agentprime.io/advisories/CVE-2026-10185.md) `CVE-2026-10185` · CVE record: SourceCodester Hospitals Patient Records Management System · CVSS 6.9 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [SourceCodester Hospitals Patient Records Management System Users.php delete sql injection](https://agentprime.io/advisories/CVE-2026-10184.md) `CVE-2026-10184` · CVE record: SourceCodester Hospitals Patient Records Management System · CVSS 6.9 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [OpenCATS - SQL Injection in DataGrid Filter Handling for Tags Column](https://agentprime.io/advisories/CVE-2026-49490.md) `CVE-2026-49490` · CVE record: OpenCATS OpenCATS · CVSS 8.6 High · Not analysed yet · Published 31 May 2026 · Tags: SQL injection - [OpenCATS - SQL Injection in DataGrid sortDirection Parameter](https://agentprime.io/advisories/CVE-2026-49489.md) `CVE-2026-49489` · CVE record: OpenCATS OpenCATS · CVSS 8.4 High · Not analysed yet · Published 31 May 2026 · Tags: SQL injection - [code-projects Online Music Site AdminEditAlbum.php sql injection](https://agentprime.io/advisories/CVE-2026-10178.md) `CVE-2026-10178` · CVE record: code-projects Online Music Site · CVSS 6.9 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [Aider-AI Aider Code Generation Workflow sql injection](https://agentprime.io/advisories/CVE-2026-10176.md) `CVE-2026-10176` · CVE record: Aider-AI Aider · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [code-projects Online Music Site AdminUpdateAlbum.php sql injection](https://agentprime.io/advisories/CVE-2026-10171.md) `CVE-2026-10171` · CVE record: code-projects Online Music Site · CVSS 5.1 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [code-projects Visitor Management System phone_0.php sql injection](https://agentprime.io/advisories/CVE-2026-10170.md) `CVE-2026-10170` · CVE record: code-projects Visitor Management System · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, SQL injection - [Bdtask Multi-Store Inventory Management System Accounts Report Accounts.php accounts_report_search sql injection](https://agentprime.io/advisories/CVE-2026-10155.md) `CVE-2026-10155` · CVE record: Bdtask Multi-Store Inventory Management System · CVSS 5.1 Medium · Not analysed yet · Published 30 May 2026 · Tags: Other injection, SQL injection - [Yot CMS 3.3.1 SQL Injection via aid and cid Parameters](https://agentprime.io/advisories/CVE-2018-25425.md) `CVE-2018-25425` · CVE record: Yot Yot CMS · CVSS 8.8 High · Not analysed yet · Published 30 May 2026 · Tags: SQL injection - [Gate Pass Management System 2.1 SQL Injection via login-exec.php](https://agentprime.io/advisories/CVE-2018-25424.md) `CVE-2018-25424` · CVE record: Livebms Gate Pass Management System · CVSS 8.8 High · Not analysed yet · Published 30 May 2026 · Tags: SQL injection - [MOGG web simulator Script All Version SQL Injection via play.php](https://agentprime.io/advisories/CVE-2018-25422.md) `CVE-2018-25422` · CVE record: spider312 MOGG web simulator Script · CVSS 8.8 High · Not analysed yet · Published 30 May 2026 · Tags: SQL injection - [AiOPMSD Final 1.0.0 SQL Injection via watch.php](https://agentprime.io/advisories/CVE-2018-25420.md) `CVE-2018-25420` · CVE record: Aiopmsd AiOPMSD Final · CVSS 8.8 High · Not analysed yet · Published 30 May 2026 · Tags: SQL injection - [AiOPMSD Final 1.0.0 SQL Injection via genre.php](https://agentprime.io/advisories/CVE-2018-25419.md) `CVE-2018-25419` · CVE record: Aiopmsd AiOPMSD Final · CVSS 8.8 High · Not analysed yet · Published 30 May 2026 · Tags: SQL injection - [AiOPMSD Final 1.0.0 SQL Injection via year.php](https://agentprime.io/advisories/CVE-2018-25418.md) `CVE-2018-25418` · CVE record: Aiopmsd AiOPMSD Final · CVSS 8.8 High · Not analysed yet · Published 30 May 2026 · Tags: SQL injection - [AiOPMSD Final 1.0.0 SQL Injection via quality.php](https://agentprime.io/advisories/CVE-2018-25417.md) `CVE-2018-25417` · CVE record: Aiopmsd AiOPMSD Final · CVSS 8.8 High · Not analysed yet · Published 30 May 2026 · Tags: SQL injection - [AiOPMSD Final 1.0.0 SQL Injection via country.php](https://agentprime.io/advisories/CVE-2018-25416.md) `CVE-2018-25416` · CVE record: Aiopmsd AiOPMSD Final · CVSS 8.8 High · Not analysed yet · Published 30 May 2026 · Tags: SQL injection - [AiOPMSD Final 1.0.0 SQL Injection via director Parameter](https://agentprime.io/advisories/CVE-2018-25415.md) `CVE-2018-25415` · CVE record: Aiopmsd AiOPMSD Final · CVSS 8.8 High · Not analysed yet · Published 30 May 2026 · Tags: SQL injection - [AiOPMSD Final 1.0.0 SQL Injection via actor.php](https://agentprime.io/advisories/CVE-2018-25414.md) `CVE-2018-25414` · CVE record: Aiopmsd AiOPMSD Final · CVSS 8.8 High · Not analysed yet · Published 30 May 2026 · Tags: SQL injection - [AiOPMSD Final 1.0.0 SQL Injection via search.php](https://agentprime.io/advisories/CVE-2018-25413.md) `CVE-2018-25413` · CVE record: Aiopmsd AiOPMSD Final · CVSS 8.8 High · Not analysed yet · Published 30 May 2026 · Tags: SQL injection - [MGB OpenSource Guestbook 0.7.0.2 SQL Injection via email.php](https://agentprime.io/advisories/CVE-2018-25411.md) `CVE-2018-25411` · CVE record: M-Gb MGB OpenSource Guestbook · CVSS 8.8 High · Not analysed yet · Published 30 May 2026 · Tags: SQL injection - [SIM-PKH 2.4.1 SQL Injection via media.php id Parameter](https://agentprime.io/advisories/CVE-2018-25410.md) `CVE-2018-25410` · CVE record: Simpkh SIM-PKH · CVSS 7.1 High · Not analysed yet · Published 30 May 2026 · Tags: SQL injection - [eNdonesia Portal 8.7 SQL Injection via mod.php](https://agentprime.io/advisories/CVE-2018-25407.md) `CVE-2018-25407` · CVE record: Endonesia eNdonesia Portal · CVSS 8.8 High · Not analysed yet · Published 30 May 2026 · Tags: SQL injection - [eNdonesia Portal 8.7 SQL Injection via mod.php](https://agentprime.io/advisories/CVE-2018-25406.md) `CVE-2018-25406` · CVE record: Endonesia eNdonesia Portal · CVSS 8.8 High · Not analysed yet · Published 30 May 2026 · Tags: SQL injection - [eNdonesia Portal 8.7 SQL Injection via mod.php](https://agentprime.io/advisories/CVE-2018-25405.md) `CVE-2018-25405` · CVE record: Endonesia eNdonesia Portal · CVSS 8.8 High · Not analysed yet · Published 30 May 2026 · Tags: SQL injection - [GEO my WP <= 4.5.5 - Unauthenticated SQL Injection via 'swlatlng' / 'nelatlng' Parameters](https://agentprime.io/advisories/CVE-2026-9757.md) `CVE-2026-9757` · CVE record: ninjew GEO my WP · CVSS 7.5 High · Not analysed yet · Published 30 May 2026 · Tags: SQL injection - [sambitraj STUDENT-MANAGEMENT-SYSTEM Login Page sql injection](https://agentprime.io/advisories/CVE-2026-10111.md) `CVE-2026-10111` · CVE record: sambitraj STUDENT-MANAGEMENT-SYSTEM · CVSS 6.9 Medium · Not analysed yet · Published 30 May 2026 · Tags: Other injection, SQL injection - [code-projects Student Details Management System index.php sql injection](https://agentprime.io/advisories/CVE-2026-10110.md) `CVE-2026-10110` · CVE record: code-projects Student Details Management System · CVSS 6.9 Medium · Not analysed yet · Published 30 May 2026 · Tags: Other injection, SQL injection - [stigmem-node's Postgres schema identifier handling required defensive quoting](https://agentprime.io/advisories/GHSA-9pc9-4crj-mhpj.md) `GHSA-9pc9-4crj-mhpj`, `CVE-2026-76240` · PyPI `stigmem-node`: affected `<0.9.0a2`, fixed in `0.9.0a2` · CVSS 7.5 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection - [AgenticMail API/storage and outbound relay hardening fixes](https://agentprime.io/advisories/GHSA-wjjv-3mj2-39hf.md) `GHSA-wjjv-3mj2-39hf`, `CVE-2026-47255` · npm `@agenticmail/api` and 1 more: affected `<0.9.32`, fixed in `0.9.32` · CVSS 8.2 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection, Broken access control, Weak cryptography or TLS, Hard-coded credentials - [ezsystems/ezpublish-legacy has a SQL injection in dfscleanup](https://agentprime.io/advisories/GHSA-xg9x-h37w-h3r3.md) `GHSA-xg9x-h37w-h3r3`, `CVE-2026-38739`, `PKSA-vrcj-tzjw-khtt` · Packagist `ezsystems/ezpublish-legacy`: affected `=2019.03`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection - [agno contains a SQL injection vulnerability](https://agentprime.io/advisories/GHSA-82m5-3pcp-hccq.md) `GHSA-82m5-3pcp-hccq`, `CVE-2026-10105`, `PYSEC-2026-2333` · PyPI `agno`: affected `<=2.6.5`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .