# SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter](https://agentprime.io/advisories/CVE-2026-6428.md)
  `CVE-2026-6428` · CVE record: Koha Community Koha · CVSS 5.6 Medium · Not analysed yet · Published 13 Jun 2026 · Tags: SQL injection
- [WP Ticket <= 6.0.4 - Unauthenticated SQL Injection via WordPress Search 's' Parameter](https://agentprime.io/advisories/CVE-2026-9848.md)
  `CVE-2026-9848` · CVE record: emarket-design Customer Support Ticket System & Helpdesk · CVSS 7.5 High · Not analysed yet · Published 13 Jun 2026 · Tags: SQL injection
- [CodeAstro Human Resource Management System Payroll Invoice Payroll.php sql injection](https://agentprime.io/advisories/CVE-2026-12131.md)
  `CVE-2026-12131` · CVE record: CodeAstro Human Resource Management System · CVSS 5.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Other injection, SQL injection
- [Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint](https://agentprime.io/advisories/GHSA-x4qr-qw6h-wvxq.md)
  `GHSA-x4qr-qw6h-wvxq`, `CVE-2026-46371`, `GO-2026-5739` · Go `github.com/fleetdm/fleet/v4`: affected `<4.84.2`, fixed in `4.84.2` · CVSS 6.5 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: SQL injection, Information disclosure
- [Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint](https://agentprime.io/advisories/GHSA-vxm7-9x8v-8gm4.md)
  `GHSA-vxm7-9x8v-8gm4`, `CVE-2026-46370`, `GO-2026-5682` · Go `github.com/fleetdm/fleet/v4`: affected `<4.84.2`, fixed in `4.84.2` · CVSS 6.5 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: SQL injection, Information disclosure
- [TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework](https://agentprime.io/advisories/GHSA-jh32-v29g-68pq.md)
  `GHSA-jh32-v29g-68pq`, `CVE-2026-49741`, `PKSA-hqhs-7j5f-td2d`, `PKSA-w8hs-qvzm-sf5x` · Packagist `typo3/cms-core` and 1 more: affected `>=14.0.0, <14.3.3`, fixed in `14.3.3` · CVSS 8.7 High · Not analysed yet · Published 12 Jun 2026 · Tags: SQL injection, Broken access control
- [MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and ...](https://agentprime.io/advisories/GHSA-pv9p-5w55-55jm.md)
  `GHSA-pv9p-5w55-55jm`, `BIT-mariadb-2026-44172`, `BIT-mariadb-min-2026-44172`, `BIT-mysql-client-2026-44172`, `CVE-2026-44172`, `PYSEC-2026-217` · PyPI `mariadb`: affected `<=3.3.18`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: SQL injection
- [Frappe Vulnerable to Possible SQL Injection via get_blog_list](https://agentprime.io/advisories/CVE-2026-41581.md)
  `CVE-2026-41581` · CVE record: frappe frappe · CVSS 6.9 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: SQL injection
- [SQL injection in phpBB](https://agentprime.io/advisories/CVE-2026-48613.md)
  `CVE-2026-48613` · CVE record: phpBB phpBB · CVSS 7.1 High · Not analysed yet · Published 12 Jun 2026 · Tags: SQL injection
- [ClipBucket: Blind SQL Injection in progress_video.php](https://agentprime.io/advisories/CVE-2026-45060.md)
  `CVE-2026-45060` · CVE record: MacWarrior clipbucket-v5 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Jun 2026 · Tags: SQL injection
- [ClipBucket: Blind SQL Injection in subtitle_edit.php](https://agentprime.io/advisories/CVE-2026-45418.md)
  `CVE-2026-45418` · CVE record: MacWarrior clipbucket-v5 · CVSS 8.8 High · Not analysed yet · Published 11 Jun 2026 · Tags: SQL injection
- [WordPress Product Filter by WBW plugin <= 3.1.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39494.md)
  `CVE-2026-39494` · CVE record: WBW Plugins Product Filter by WBW · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Jun 2026 · Tags: SQL injection
- [WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42647.md)
  `CVE-2026-42647` · CVE record: Beardev JoomSport · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Jun 2026 · Tags: SQL injection
- [PostgreSQL Anonymizer: SQL injection in the rules import functions](https://agentprime.io/advisories/CVE-2026-11945.md)
  `CVE-2026-11945` · CVE record: DALIBO PostgreSQL Anonymizer · CVSS 6.4 Medium · Not analysed yet · Published 11 Jun 2026 · Tags: SQL injection
- [SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote attackers to execute arbitrary SQL commands via the idFormMain parameter to /substudy/ezform.php (line 14)…](https://agentprime.io/advisories/CVE-2026-38581.md)
  `CVE-2026-38581` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Jun 2026 · Tags: SQL injection
- [Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands](https://agentprime.io/advisories/GHSA-vf2h-7x3w-97fr.md)
  `GHSA-vf2h-7x3w-97fr`, `CVE-2026-53474`, `GO-2026-6233` · Go `github.com/kubev2v/migration-planner`: affected `<0.13.5`, fixed in `0.13.5` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jun 2026 · Tags: SQL injection
- [Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search](https://agentprime.io/advisories/CVE-2026-52758.md)
  `CVE-2026-52758` · CVE record: nationalsecurityagency ghidra · CVSS 8.7 High · Not analysed yet · Published 10 Jun 2026 · Tags: SQL injection
- [Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username](https://agentprime.io/advisories/CVE-2026-49498.md)
  `CVE-2026-49498` · CVE record: nationalsecurityagency ghidra · CVSS 8.7 High · Not analysed yet · Published 10 Jun 2026 · Tags: SQL injection
- [Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter](https://agentprime.io/advisories/CVE-2026-3018.md)
  `CVE-2026-3018` · CVE record: contrid Newsletters · CVSS 7.5 High · Not analysed yet · Published 10 Jun 2026 · Tags: SQL injection
- [XStore < 9.7.3 - Unauthenticated SQLi](https://agentprime.io/advisories/CVE-2026-3326.md)
  `CVE-2026-3326` · CVE record: Unknown Xstore · CVSS 8.6 High · Not analysed yet · Published 10 Jun 2026 · Tags: SQL injection
- [LimeSurvey has a SQL Injection issue](https://agentprime.io/advisories/GHSA-pr6f-87hf-hx24.md)
  `GHSA-pr6f-87hf-hx24`, `CVE-2026-50636`, `PKSA-jm8r-vn8x-qc36` · Packagist `limesurvey/limesurvey`: affected `<=7.0.0-beta1`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 9 Jun 2026 · Tags: SQL injection
- [SQLi in MOSK Informatics' CBS Platform](https://agentprime.io/advisories/CVE-2026-8025.md)
  `CVE-2026-8025` · CVE record: MOSK Information Technologies Ltd. CBS Platform · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2026 · Tags: SQL injection
- [SQLi in Netcad's E-İmar](https://agentprime.io/advisories/CVE-2026-7486.md)
  `CVE-2026-7486` · CVE record: Netcad Software Inc. E-İmar · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2026 · Tags: SQL injection
- [WordPress Plugin Apptha Slider Gallery 1.0 SQL Injection](https://agentprime.io/advisories/CVE-2017-20249.md)
  `CVE-2017-20249` · CVE record: apptha Apptha Slider Gallery · CVSS 8.8 High · Not analysed yet · Published 9 Jun 2026 · Tags: SQL injection
- [WordPress Plugin PICA Photo Gallery 1.0 SQL Injection](https://agentprime.io/advisories/CVE-2017-20247.md)
  `CVE-2017-20247` · CVE record: Apptha PICA Photo Gallery · CVSS 8.8 High · Not analysed yet · Published 9 Jun 2026 · Tags: SQL injection
- [KittyCatfish 2.2 Plugin for WordPress SQL Injection](https://agentprime.io/advisories/CVE-2017-20246.md)
  `CVE-2017-20246` · CVE record: Missilesilo KittyCatfish · CVSS 8.8 High · Not analysed yet · Published 9 Jun 2026 · Tags: SQL injection
- [Wow Viral Signups 2.1 WordPress Plugin SQL Injection](https://agentprime.io/advisories/CVE-2017-20245.md)
  `CVE-2017-20245` · CVE record: Wow-Company Wow Viral Signups · CVSS 8.8 High · Not analysed yet · Published 9 Jun 2026 · Tags: SQL injection
- [Wow Forms WordPress Plugin 2.1 SQL Injection](https://agentprime.io/advisories/CVE-2017-20244.md)
  `CVE-2017-20244` · CVE record: Wow-Company Wow Forms · CVSS 8.8 High · Not analysed yet · Published 9 Jun 2026 · Tags: SQL injection
- [WordPress Car Park Booking Plugin SQL Injection via space_id](https://agentprime.io/advisories/CVE-2017-20243.md)
  `CVE-2017-20243` · CVE record: gurutechteam Car Park Booking WordPress Plugin · CVSS 8.8 High · Not analysed yet · Published 9 Jun 2026 · Tags: SQL injection
- [Product Catalog 8 1.2 Plugin WordPress SQL Injection](https://agentprime.io/advisories/CVE-2016-20065.md)
  `CVE-2016-20065` · CVE record: EvWill Product Catalog 8 · CVSS 8.8 High · Not analysed yet · Published 9 Jun 2026 · Tags: SQL injection
- [Single Personal Message 1.0.3 WordPress Plugin SQL Injection](https://agentprime.io/advisories/CVE-2016-20063.md)
  `CVE-2016-20063` · CVE record: Md. Shamim Shahnewaz Single Personal Message · CVSS 7.1 High · Not analysed yet · Published 9 Jun 2026 · Tags: SQL injection
- [Simply Poll 1.4.1 Plugin for WordPress SQL Injection](https://agentprime.io/advisories/CVE-2016-20062.md)
  `CVE-2016-20062` · CVE record: Ollie Armstrong Simply Poll · CVSS 8.8 High · Not analysed yet · Published 9 Jun 2026 · Tags: SQL injection
- [SQL injection in Nemon products](https://agentprime.io/advisories/CVE-2026-10731.md)
  `CVE-2026-10731` · CVE record: Nemon Nemon Trade Energy and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2026 · Tags: SQL injection
- [SQL Injection vulnerability in SAP S/4HANA](https://agentprime.io/advisories/CVE-2026-44744.md)
  `CVE-2026-44744` · CVE record: SAP_SE SAP S/4HANA · CVSS 6.5 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: SQL injection
- [FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString](https://agentprime.io/advisories/GHSA-h9fj-c2qr-76g2.md)
  `GHSA-h9fj-c2qr-76g2`, `CVE-2026-47720` · npm `fuxa-server`: affected `<=1.1.14-1243`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: SQL injection
- [CodeAstro Student Attendance Management System createClassArms.php sql injection](https://agentprime.io/advisories/CVE-2026-11585.md)
  `CVE-2026-11585` · CVE record: CodeAstro Student Attendance Management System · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [CodeAstro Student Attendance Management System createClass.php edit sql injection](https://agentprime.io/advisories/CVE-2026-11584.md)
  `CVE-2026-11584` · CVE record: CodeAstro Student Attendance Management System · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [CodeAstro Student Attendance Management System createClass.php sql injection](https://agentprime.io/advisories/CVE-2026-11583.md)
  `CVE-2026-11583` · CVE record: CodeAstro Student Attendance Management System · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [CodeAstro Student Attendance Management System index.php sql injection](https://agentprime.io/advisories/CVE-2026-11582.md)
  `CVE-2026-11582` · CVE record: CodeAstro Student Attendance Management System · CVSS 6.9 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [CodeAstro Payroll System view_account.php sql injection](https://agentprime.io/advisories/CVE-2026-11559.md)
  `CVE-2026-11559` · CVE record: CodeAstro Payroll System · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [MySQL MCP Server is Vulnerable to SQL Injection Through its mysql URI Handler](https://agentprime.io/advisories/GHSA-mvq4-39wx-6h5g.md)
  `GHSA-mvq4-39wx-6h5g`, `CVE-2026-11529`, `PYSEC-2026-3579` · PyPI `mysql-mcp-server`: affected `<0.3.0`, fixed in `0.3.0` · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [CodeAstro Payroll System home_salary.php sql injection](https://agentprime.io/advisories/CVE-2026-11558.md)
  `CVE-2026-11558` · CVE record: CodeAstro Payroll System · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [imvks786 student_management_system Administrator Login Endpoint admin_login.php sql injection](https://agentprime.io/advisories/CVE-2026-11531.md)
  `CVE-2026-11531` · CVE record: imvks786 student_management_system · CVSS 6.9 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [imvks786 student_management_system Login index.ph sql injection](https://agentprime.io/advisories/CVE-2026-11530.md)
  `CVE-2026-11530` · CVE record: imvks786 student_management_system · CVSS 6.9 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System addpatient.php sql injection](https://agentprime.io/advisories/CVE-2026-11514.md)
  `CVE-2026-11514` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System adminaccount.php sql injection](https://agentprime.io/advisories/CVE-2026-11513.md)
  `CVE-2026-11513` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [CodeAstro Leave Management System add_leave.php sql injection](https://agentprime.io/advisories/CVE-2026-11510.md)
  `CVE-2026-11510` · CVE record: CodeAstro Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [CodeAstro Leave Management System search_staff_for_updation.php sql injection](https://agentprime.io/advisories/CVE-2026-11509.md)
  `CVE-2026-11509` · CVE record: CodeAstro Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [CodeAstro Leave Management System search_staff_to_assign_pc.php sql injection](https://agentprime.io/advisories/CVE-2026-11508.md)
  `CVE-2026-11508` · CVE record: CodeAstro Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [CodeAstro Leave Management System delete_leave_type.php sql injection](https://agentprime.io/advisories/CVE-2026-11507.md)
  `CVE-2026-11507` · CVE record: CodeAstro Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [CodeAstro Leave Management System search_staff_for_deletion.php sql injection](https://agentprime.io/advisories/CVE-2026-11506.md)
  `CVE-2026-11506` · CVE record: CodeAstro Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [SourceCodester Hospitals Patient Records Management System Master.php save_patient sql injection](https://agentprime.io/advisories/CVE-2026-11501.md)
  `CVE-2026-11501` · CVE record: SourceCodester Hospitals Patient Records Management System · CVSS 6.9 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [CodeAstro Ingredients Stock Management System add_stock.php sql injection](https://agentprime.io/advisories/CVE-2026-11495.md)
  `CVE-2026-11495` · CVE record: CodeAstro Ingredients Stock Management System · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [code-projects Online Music Site Search.php sql injection](https://agentprime.io/advisories/CVE-2026-11490.md)
  `CVE-2026-11490` · CVE record: code-projects Online Music Site · CVSS 6.9 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [code-projects Online Music Site AdminDeleteAlbum.php sql injection](https://agentprime.io/advisories/CVE-2026-11489.md)
  `CVE-2026-11489` · CVE record: code-projects Online Music Site · CVSS 6.9 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [code-projects Simple Flight Ticket Booking System POST Parameter checkUser.php sql injection](https://agentprime.io/advisories/CVE-2026-11488.md)
  `CVE-2026-11488` · CVE record: code-projects Simple Flight Ticket Booking System · CVSS 6.9 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [SourceCodester Class and Exam Timetabling System archive1.php sql injection](https://agentprime.io/advisories/CVE-2026-11486.md)
  `CVE-2026-11486` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [SourceCodester Class and Exam Timetabling System archive2.php sql injection](https://agentprime.io/advisories/CVE-2026-11485.md)
  `CVE-2026-11485` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [SourceCodester Class and Exam Timetabling System archive3.php sql injection](https://agentprime.io/advisories/CVE-2026-11484.md)
  `CVE-2026-11484` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection
- [SourceCodester Class and Exam Timetabling System archive4.php sql injection](https://agentprime.io/advisories/CVE-2026-11483.md)
  `CVE-2026-11483` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection, SQL injection

Newest: <https://agentprime.io/advisories/tag/sql-injection.md>
Older: <https://agentprime.io/advisories/tag/sql-injection.md?cursor=WyIyMDI2LTA2LTA4VDAzOjE1OjA4Ljg2NjAwMFoiLCJDVkUtMjAyNi0xMTQ4MyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=sql-injection&cursor=WyIyMDI2LTA2LTEzVDIyOjQ1OjA2LjQ0MjAwMFoiLCJDVkUtMjAyNi0xMjE3NSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/sql-injection/?cursor=WyIyMDI2LTA2LTEzVDIyOjQ1OjA2LjQ0MjAwMFoiLCJDVkUtMjAyNi0xMjE3NSJd>. Everything for agents: <https://agentprime.io/llms.txt>.