# SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Joomla JoomRecipe 1.0.3 SQL Injection via category parameter](https://agentprime.io/advisories/CVE-2017-20278.md)
  `CVE-2017-20278` · CVE record: Joomboost JoomRecipe · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla JoomRecipe 1.0.4 Component Blind SQL Injection via search_author](https://agentprime.io/advisories/CVE-2017-20277.md)
  `CVE-2017-20277` · CVE record: Joomboost Joomla JoomRecipe · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla! Component SIMGenealogy 2.1.5 SQL Injection](https://agentprime.io/advisories/CVE-2017-20276.md)
  `CVE-2017-20276` · CVE record: Simbunch SIMGenealogy · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla! Component PHP-Bridge 1.2.3 SQL Injection via id Parameter](https://agentprime.io/advisories/CVE-2017-20275.md)
  `CVE-2017-20275` · CVE record: Henryschorradt Bridge · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla LMS King Professional 3.2.4.0 SQL Injection via learningpath](https://agentprime.io/advisories/CVE-2017-20274.md)
  `CVE-2017-20274` · CVE record: King-products LMS King Professional · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla Event Registration Pro Calendar 4.1.3 SQL Injection](https://agentprime.io/advisories/CVE-2017-20273.md)
  `CVE-2017-20273` · CVE record: Joomlashowroom Event Registration Pro Calendar · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla Ultimate Property Listing 1.0.2 SQL Injection via sf_selectuser_id](https://agentprime.io/advisories/CVE-2017-20272.md)
  `CVE-2017-20272` · CVE record: Faboba Ultimate Property Listing · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla StreetGuessr Game 1.1.8 SQL Injection via catid](https://agentprime.io/advisories/CVE-2017-20271.md)
  `CVE-2017-20271` · CVE record: Nordmograph StreetGuessr Game · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla! Component Twitch Tv 1.1 SQL Injection](https://agentprime.io/advisories/CVE-2017-20270.md)
  `CVE-2017-20270` · CVE record: Raindropsinfotech Twitch Tv · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla! Component KissGallery 1.0.0 SQL Injection](https://agentprime.io/advisories/CVE-2017-20269.md)
  `CVE-2017-20269` · CVE record: Terrywcarter KissGallery · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla! Component Zap Calendar Lite 4.3.4 SQL Injection](https://agentprime.io/advisories/CVE-2017-20268.md)
  `CVE-2017-20268` · CVE record: Zcontent Zap Calendar Lite · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla! Component Calendar Planner 1.0.1 SQL Injection](https://agentprime.io/advisories/CVE-2017-20267.md)
  `CVE-2017-20267` · CVE record: Joomlathat Calendar Planner · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla SP Movie Database 1.3 SQL Injection via searchword](https://agentprime.io/advisories/CVE-2017-20266.md)
  `CVE-2017-20266` · CVE record: Joomshaper SP Movie Database · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla! Component Flip Wall 8.0 SQL Injection](https://agentprime.io/advisories/CVE-2017-20265.md)
  `CVE-2017-20265` · CVE record: Pulseextensions Flip Wall · CVSS 7.1 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla! Component Sponsor Wall 8.0 SQL Injection](https://agentprime.io/advisories/CVE-2017-20264.md)
  `CVE-2017-20264` · CVE record: Pulseextensions Sponsor Wall · CVSS 7.1 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla! FocalPoint Pro Free 1.2.3 SQL Injection via location](https://agentprime.io/advisories/CVE-2017-20263.md)
  `CVE-2017-20263` · CVE record: Focalpointx FocalPoint Pro / Free · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla! Component Ajax Quiz 1.8 SQL Injection](https://agentprime.io/advisories/CVE-2017-20262.md)
  `CVE-2017-20262` · CVE record: Webkul Ajax Quiz · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla! Component Bargain Product VM3 1.0 SQL Injection](https://agentprime.io/advisories/CVE-2017-20261.md)
  `CVE-2017-20261` · CVE record: Weborange Bargain Product VM3 · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla! Component Price Alert 3.0.2 SQL Injection](https://agentprime.io/advisories/CVE-2017-20260.md)
  `CVE-2017-20260` · CVE record: Weborange Price Alert · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla OSDownloads 1.7.4 SQL Injection via item view](https://agentprime.io/advisories/CVE-2017-20259.md)
  `CVE-2017-20259` · CVE record: Joomlashack OSDownloads · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla! Component RPC Responsive Portfolio 1.6.1 SQL Injection](https://agentprime.io/advisories/CVE-2017-20258.md)
  `CVE-2017-20258` · CVE record: Extro RPC · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla! Component Quiz Deluxe 3.7.4 SQL Injection](https://agentprime.io/advisories/CVE-2017-20257.md)
  `CVE-2017-20257` · CVE record: Joomplace Quiz Deluxe · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla Survey Force Deluxe 3.2.4 SQL Injection via invite Parameter](https://agentprime.io/advisories/CVE-2017-20256.md)
  `CVE-2017-20256` · CVE record: Joomplace Survey Force Deluxe · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla! Component JB Visa 1.0 SQL Injection via visatype](https://agentprime.io/advisories/CVE-2017-20255.md)
  `CVE-2017-20255` · CVE record: Joombooking JB Visa · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla! Component User Bench 1.0 SQL Injection via userid](https://agentprime.io/advisories/CVE-2017-20254.md)
  `CVE-2017-20254` · CVE record: Gegabyte User Bench · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla! Component My Projects 2.0 SQL Injection](https://agentprime.io/advisories/CVE-2017-20253.md)
  `CVE-2017-20253` · CVE record: Gegabyte My Projects · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [Joomla NextGen Editor 2.1.0 SQL Injection via plname Parameter](https://agentprime.io/advisories/CVE-2017-20252.md)
  `CVE-2017-20252` · CVE record: nextgeneditor NextGen Editor · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection
- [pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution](https://agentprime.io/advisories/CVE-2026-12045.md)
  `CVE-2026-12045` · CVE record: pgadmin.org pgAdmin 4 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Command injection, SQL injection
- [pgAdmin 4: SQL injection in named restore point endpoint](https://agentprime.io/advisories/CVE-2026-12050.md)
  `CVE-2026-12050` · CVE record: pgadmin.org pgAdmin 4 · CVSS 5.3 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: SQL injection
- [pgAdmin 4: SQL injection in COMMENT ON ... IS '\<description>' rendering across dialog templates](https://agentprime.io/advisories/CVE-2026-12044.md)
  `CVE-2026-12044` · CVE record: pgadmin.org pgAdmin 4 · CVSS 8.7 High · Not analysed yet · Published 18 Jun 2026 · Tags: SQL injection, CWE-116
- [budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL](https://agentprime.io/advisories/GHSA-qqf5-x7mj-v43p.md)
  `GHSA-qqf5-x7mj-v43p`, `CVE-2026-64657` · npm `budibase`: affected `<3.39.19`, fixed in `3.39.19` · CVSS 8.4 High · Not analysed yet · Published 18 Jun 2026 · Tags: SQL injection
- [WordPress Media LIbrary Assistant plugin <= 3.35 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-56012.md)
  `CVE-2026-56012` · CVE record: David Lingren Media LIbrary Assistant · CVSS 8.5 High · Not analysed yet · Published 18 Jun 2026 · Tags: SQL injection
- [Blind SQL Injection in UBB.threads](https://agentprime.io/advisories/CVE-2026-54222.md)
  `CVE-2026-54222` · CVE record: UBB Systems UBB.threads · CVSS 8.6 High · Not analysed yet · Published 18 Jun 2026 · Tags: SQL injection
- [SQL Injection in LMS](https://agentprime.io/advisories/CVE-2026-40455.md)
  `CVE-2026-40455` · CVE record: LMS LMS · CVSS 8.6 High · Not analysed yet · Published 18 Jun 2026 · Tags: SQL injection
- [PIAF-HMS multiple unauthenticated SQL injection vulnerabilities via mysql_query](https://agentprime.io/advisories/CVE-2026-54419.md)
  `CVE-2026-54419` · CVE record: claudiopizzillo PIAF-HMS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: SQL injection
- [SQL Injection in Nur-Alam39 bus-ticket bus_info.php via busid parameter](https://agentprime.io/advisories/CVE-2026-55740.md)
  `CVE-2026-55740` · CVE record: Nur-Alam39 bus-ticket · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: SQL injection
- [Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter](https://agentprime.io/advisories/CVE-2026-10736.md)
  `CVE-2026-10736` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 4.9 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: SQL injection
- [Advanced Order Export For WooCommerce <= 4.0.10 - Authenticated (Shop Manager+) SQL Injection via 'sort_direction' Parameter](https://agentprime.io/advisories/CVE-2026-11360.md)
  `CVE-2026-11360` · CVE record: algolplus Advanced Order Export For WooCommerce · CVSS 4.9 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: SQL injection
- [Form Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter](https://agentprime.io/advisories/CVE-2026-11776.md)
  `CVE-2026-11776` · CVE record: 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder · CVSS 4.9 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: SQL injection
- [Form Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' Parameter](https://agentprime.io/advisories/CVE-2026-11777.md)
  `CVE-2026-11777` · CVE record: 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder · CVSS 4.9 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: SQL injection
- [LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector](https://agentprime.io/advisories/GHSA-2mfg-cc43-9pcj.md)
  `GHSA-2mfg-cc43-9pcj`, `CVE-2026-55405` · Maven `dev.langchain4j:langchain4j-mariadb` and 1 more: affected `<1.2.1-beta8 || >=1.3.0-beta9, <1.5.1-beta11 || >=1.6.0-beta12, <1.11.8-beta19 || >=1.12.1-beta21, <1.16.3-beta26`, fixed in `1.2.1-beta8`, `1.5.1-beta11`, `1.11.8-beta19`, `1.16.3-beta26` · CVSS 7.6 High · Not analysed yet · Published 17 Jun 2026 · Tags: SQL injection
- [SQL injection in Dell PowerFlex](https://agentprime.io/advisories/CVE-2026-35069.md)
  `CVE-2026-35069` · CVE record: Dell PowerFlex · CVSS 5.7 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: SQL injection
- [SQL injection in Dell PowerFlex](https://agentprime.io/advisories/CVE-2026-35068.md)
  `CVE-2026-35068` · CVE record: Dell PowerFlex · CVSS 3.5 Low · Not analysed yet · Published 17 Jun 2026 · Tags: SQL injection
- [WordPress Motors plugin <= 1.4.109 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54812.md)
  `CVE-2026-54812` · CVE record: StylemixThemes Motors · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: SQL injection
- [WordPress GIFT4U plugin <= 1.0.10 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54809.md)
  `CVE-2026-54809` · CVE record: VillaTheme GIFT4U · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: SQL injection
- [WordPress WP Travel Gutenberg Blocks plugin <= 3.9.4 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54808.md)
  `CVE-2026-54808` · CVE record: WP Travel WP Travel Gutenberg Blocks · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: SQL injection
- [WordPress SureDash plugin <= 1.8.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54813.md)
  `CVE-2026-54813` · CVE record: Brainstorm Force SureDash · CVSS 8.5 High · Not analysed yet · Published 17 Jun 2026 · Tags: SQL injection
- [WordPress Cargo Shipping Location for WooCommerce plugin <= 5.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54815.md)
  `CVE-2026-54815` · CVE record: Cargo RD Cargo Shipping Location for WooCommerce · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: SQL injection
- [WordPress Slimstat Analytics plugin <= 5.4.11 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54818.md)
  `CVE-2026-54818` · CVE record: VeronaLabs Slimstat Analytics · CVSS 8.5 High · Not analysed yet · Published 17 Jun 2026 · Tags: SQL injection
- [WordPress Listdom plugin <= 5.4.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54819.md)
  `CVE-2026-54819` · CVE record: Webilia Inc. Listdom · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: SQL injection
- [WordPress Advanced Ads – Tracking plugin < 3.0.7 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2025-59554.md)
  `CVE-2025-59554` · CVE record: Advanced Ads GmbH Advanced Ads – Tracking · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: SQL injection
- [WordPress WP eMember plugin < v10.9.4 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54811.md)
  `CVE-2026-54811` · CVE record: Tips and Tricks HQ WP eMember · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: SQL injection
- [WordPress JetEngine plugin <= 3.8.10.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54187.md)
  `CVE-2026-54187` · CVE record: Jetimpex Inc. JetEngine · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: SQL injection
- [WordPress JobSearch plugin <= 3.2.9 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54186.md)
  `CVE-2026-54186` · CVE record: eyecix JobSearch · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: SQL injection
- [WordPress Cornerstone plugin < 7.8.8 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54185.md)
  `CVE-2026-54185` · CVE record: THEMECO Cornerstone · CVSS 8.5 High · Not analysed yet · Published 17 Jun 2026 · Tags: SQL injection
- [WordPress JetEngine plugin < 3.8.9.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-49084.md)
  `CVE-2026-49084` · CVE record: Jetimpex Inc. JetEngine · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: SQL injection
- [WordPress JetSearch plugin <= 3.5.17 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-49079.md)
  `CVE-2026-49079` · CVE record: Jetimpex Inc. JetSearch · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: SQL injection
- [WordPress JetEngine plugin <= 3.8.9.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-49076.md)
  `CVE-2026-49076` · CVE record: Crocoblock JetEngine · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: SQL injection
- [WordPress Geo Mashup plugin <= 1.13.19 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-48967.md)
  `CVE-2026-48967` · CVE record: Dylan Kuhn Geo Mashup · CVSS 8.5 High · Not analysed yet · Published 17 Jun 2026 · Tags: SQL injection
- [WordPress JetSmartFilters plugin <= 3.8.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-48875.md)
  `CVE-2026-48875` · CVE record: Jetimpex Inc. JetSmartFilters · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: SQL injection

Newest: <https://agentprime.io/advisories/tag/sql-injection.md>
Older: <https://agentprime.io/advisories/tag/sql-injection.md?cursor=WyIyMDI2LTA2LTE3VDA5OjUxOjE2LjYwNzAwMFoiLCJDVkUtMjAyNi00ODg3NSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=sql-injection&cursor=WyIyMDI2LTA2LTE5VDE2OjQ4OjEyLjc0MTAwMFoiLCJDVkUtMjAxNy0yMDI3OSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/sql-injection/?cursor=WyIyMDI2LTA2LTE5VDE2OjQ4OjEyLjc0MTAwMFoiLCJDVkUtMjAxNy0yMDI3OSJd>. Everything for agents: <https://agentprime.io/llms.txt>.