# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [WordPress WC Vendors Marketplace plugin <= 2.6.8 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54838.md) `CVE-2026-54838` · CVE record: Rymera Web Co WC Vendors Marketplace · CVSS 8.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: SQL injection - [WordPress SALESmanago & Leadoo plugin <= 3.11.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54822.md) `CVE-2026-54822` · CVE record: SALESmanago SALESmanago & Leadoo · CVSS 8.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: SQL injection - [Tourfic <= 2.22.7 - Unauthenticated SQL Injection via 'post_id' Parameter](https://agentprime.io/advisories/CVE-2026-12937.md) `CVE-2026-12937` · CVE record: themefic Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: SQL injection - [Gravity Forms Booking <= 2.7.1 - Authenticated (Subscriber+) Time-Based SQL Injection via 'staff_id'](https://agentprime.io/advisories/CVE-2026-2508.md) `CVE-2026-2508` · CVE record: GravityMore Gravity Bookings · CVSS 6.5 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: SQL injection - [Dokan Pro <= 5.0.4 - Unauthenticated SQL Injection via 'latitude' and 'longitude' Parameters](https://agentprime.io/advisories/CVE-2026-12077.md) `CVE-2026-12077` · CVE record: wedevs Dokan Pro · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: SQL injection - [Dokan Pro <= 5.0.4 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter](https://agentprime.io/advisories/CVE-2026-12079.md) `CVE-2026-12079` · CVE record: wedevs Dokan Pro · CVSS 6.5 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: SQL injection - [GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/search_products.php.](https://agentprime.io/advisories/CVE-2026-37149.md) `CVE-2026-37149` · CVE record · CVSS 7.7 High · Not analysed yet · Published 25 Jun 2026 · Tags: SQL injection - [Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-9786.md) `CVE-2026-9786` · CVE record: Quest NetVault Backup · CVSS 8.8 High · Not analysed yet · Published 24 Jun 2026 · Tags: SQL injection - [Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-9785.md) `CVE-2026-9785` · CVE record: Quest NetVault Backup · CVSS 8.8 High · Not analysed yet · Published 24 Jun 2026 · Tags: SQL injection - [Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-9784.md) `CVE-2026-9784` · CVE record: Quest NetVault Backup · CVSS 8.8 High · Not analysed yet · Published 24 Jun 2026 · Tags: SQL injection - [Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-9783.md) `CVE-2026-9783` · CVE record: Quest NetVault Backup · CVSS 8.8 High · Not analysed yet · Published 24 Jun 2026 · Tags: SQL injection - [Cacti: Stored SQL Injection via graph_name_regexp in Reports feature](https://agentprime.io/advisories/CVE-2026-39951.md) `CVE-2026-39951` · CVE record: Cacti cacti · CVSS 7.6 High · Not analysed yet · Published 24 Jun 2026 · Tags: SQL injection - [Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-9782.md) `CVE-2026-9782` · CVE record: Quest NetVault Backup · CVSS 8.8 High · Not analysed yet · Published 24 Jun 2026 · Tags: SQL injection - [Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-9781.md) `CVE-2026-9781` · CVE record: Quest NetVault Backup · CVSS 8.8 High · Not analysed yet · Published 24 Jun 2026 · Tags: SQL injection - [Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-7570.md) `CVE-2026-7570` · CVE record: Quest NetVault Backup · CVSS 8.8 High · Not analysed yet · Published 24 Jun 2026 · Tags: SQL injection - [Cacti has SQL Injection via rfilter parameter in RLIKE clauses](https://agentprime.io/advisories/CVE-2026-39948.md) `CVE-2026-39948` · CVE record: Cacti cacti · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2026 · Tags: SQL injection - [Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php](https://agentprime.io/advisories/CVE-2026-39955.md) `CVE-2026-39955` · CVE record: Cacti cacti · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2026 · Tags: SQL injection - [Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php](https://agentprime.io/advisories/CVE-2026-39893.md) `CVE-2026-39893` · CVE record: Cacti cacti · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2026 · Tags: SQL injection - [WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.5 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-56052.md) `CVE-2026-56052` · CVE record: FunnelKit Funnel Builder by FunnelKit · CVSS 7.6 High · Not analysed yet · Published 24 Jun 2026 · Tags: SQL injection - [ClearSale Total <= 3.4.2 - Unauthenticated SQL Injection](https://agentprime.io/advisories/CVE-2026-8705.md) `CVE-2026-8705` · CVE record: clearsale ClearSale Total · CVSS 7.5 High · Not analysed yet · Published 24 Jun 2026 · Tags: SQL injection - [WP Forms Connector <= 1.8 - Unauthenticated SQL Injection via 'order' Parameter](https://agentprime.io/advisories/CVE-2026-9179.md) `CVE-2026-9179` · CVE record: hancock11 WP Forms Connector · CVSS 7.5 High · Not analysed yet · Published 24 Jun 2026 · Tags: SQL injection - [Budibase has nonymous NoSQL operator injection via published-app query templates](https://agentprime.io/advisories/GHSA-8qv3-p479-cj62.md) `GHSA-8qv3-p479-cj62`, `CVE-2026-54350` · npm `@budibase/server`: affected `<3.39.12`, fixed in `3.39.12` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jun 2026 · Tags: SQL injection, Other injection - [SQL injection in Revive Adserver](https://agentprime.io/advisories/CVE-2026-34914.md) `CVE-2026-34914` · CVE record: Revive Adserver · CVSS 8.3 High · Not analysed yet · Published 23 Jun 2026 · Tags: SQL injection - [SQL Injection vulnerability in Cboard v.0.4.2 and before allows a remote attacker to execute arbitrary code via the getDimensionsValues component](https://agentprime.io/advisories/CVE-2026-52673.md) `CVE-2026-52673` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 23 Jun 2026 · Tags: SQL injection - [An issue in the sqlo_untry component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.](https://agentprime.io/advisories/CVE-2025-61029.md) `CVE-2025-61029` · CVE record · CVSS 7.5 High · Not analysed yet · Published 23 Jun 2026 · Tags: SQL injection - [An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.](https://agentprime.io/advisories/CVE-2025-61028.md) `CVE-2025-61028` · CVE record · CVSS 7.5 High · Not analysed yet · Published 23 Jun 2026 · Tags: SQL injection, Denial of service - [An issue in the t_set_push component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.](https://agentprime.io/advisories/CVE-2025-61027.md) `CVE-2025-61027` · CVE record · CVSS 7.5 High · Not analysed yet · Published 23 Jun 2026 · Tags: SQL injection - [An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.](https://agentprime.io/advisories/CVE-2025-61025.md) `CVE-2025-61025` · CVE record · CVSS 7.5 High · Not analysed yet · Published 23 Jun 2026 · Tags: SQL injection, Denial of service - [An issue in the sqlo_try_in_loop component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.](https://agentprime.io/advisories/CVE-2025-61024.md) `CVE-2025-61024` · CVE record · CVSS 7.5 High · Not analysed yet · Published 23 Jun 2026 · Tags: SQL injection - [An issue in the st_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.](https://agentprime.io/advisories/CVE-2025-61023.md) `CVE-2025-61023` · CVE record · CVSS 7.5 High · Not analysed yet · Published 23 Jun 2026 · Tags: SQL injection - [An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.](https://agentprime.io/advisories/CVE-2025-61022.md) `CVE-2025-61022` · CVE record · CVSS 7.5 High · Not analysed yet · Published 23 Jun 2026 · Tags: SQL injection - [An issue in the sqlo_natural_join_cond component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.](https://agentprime.io/advisories/CVE-2025-61021.md) `CVE-2025-61021` · CVE record · CVSS 7.5 High · Not analysed yet · Published 23 Jun 2026 · Tags: SQL injection - [An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.](https://agentprime.io/advisories/CVE-2025-61020.md) `CVE-2025-61020` · CVE record · CVSS 7.5 High · Not analysed yet · Published 23 Jun 2026 · Tags: SQL injection - [An issue in the sqlo_key_part_best component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.](https://agentprime.io/advisories/CVE-2025-61019.md) `CVE-2025-61019` · CVE record · CVSS 7.5 High · Not analysed yet · Published 23 Jun 2026 · Tags: SQL injection - [An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.](https://agentprime.io/advisories/CVE-2025-61018.md) `CVE-2025-61018` · CVE record · CVSS 7.5 High · Not analysed yet · Published 23 Jun 2026 · Tags: SQL injection - [Cap-go - SQL Injection in Cloudflare Analytics Engine Queries via cloudflare.ts](https://agentprime.io/advisories/CVE-2026-56221.md) `CVE-2026-56221` · CVE record: Cap-go capgo · CVSS 7.1 High · Not analysed yet · Published 22 Jun 2026 · Tags: SQL injection - [SQL injection in Dell Wyse Management Suite (WMS)](https://agentprime.io/advisories/CVE-2026-44271.md) `CVE-2026-44271` · CVE record: Dell Wyse Management Suite (WMS) · CVSS 8.1 High · Not analysed yet · Published 22 Jun 2026 · Tags: SQL injection - [SQL injection in Dell Wyse Management Suite (WMS)](https://agentprime.io/advisories/CVE-2026-44272.md) `CVE-2026-44272` · CVE record: Dell Wyse Management Suite (WMS) · CVSS 8.8 High · Not analysed yet · Published 22 Jun 2026 · Tags: SQL injection - [IBM Sterling File Gateway SQL Injection](https://agentprime.io/advisories/CVE-2026-7253.md) `CVE-2026-7253` · CVE record: IBM Sterling B2B Integrator and 1 more · CVSS 6.0 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: SQL injection - [Apache Doris MCP Server is vulnerable to SQL Injection via metadata query path](https://agentprime.io/advisories/GHSA-pqrj-4gwg-h5f7.md) `GHSA-pqrj-4gwg-h5f7`, `CVE-2025-66336`, `PYSEC-2026-4048` · PyPI `doris-mcp-server`: affected `<0.6.1`, fixed in `0.6.1` · CVSS 8.1 High · Not analysed yet · Published 22 Jun 2026 · Tags: SQL injection - [ILIAS Learning Management System Learning Progress Tracking class.ilTrQuery.php executeQueries sql injection](https://agentprime.io/advisories/CVE-2026-12789.md) `CVE-2026-12789` · CVE record: ILIAS Learning Management System · CVSS 5.1 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Other injection, SQL injection - [Montodel House-Rental-Management index.php houses sql injection](https://agentprime.io/advisories/CVE-2026-12776.md) `CVE-2026-12776` · CVE record: Montodel House-Rental-Management · CVSS 5.3 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Other injection, SQL injection - [Montodel House-Rental-Management login.php sql injection](https://agentprime.io/advisories/CVE-2026-12775.md) `CVE-2026-12775` · CVE record: Montodel House-Rental-Management · CVSS 6.9 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Other injection, SQL injection - [TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)](https://agentprime.io/advisories/GHSA-9ggv-8w38-r7pm.md) `GHSA-9ggv-8w38-r7pm` · npm `typeorm`: affected `>=0.1.12, <0.3.29`, fixed in `0.3.29` · CVSS 5.9 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection - [Joomla! Component JoomCRM 1.1.1 SQL Injection via deal_id](https://agentprime.io/advisories/CVE-2019-25761.md) `CVE-2019-25761` · CVE record: Joomboost JoomCRM · CVSS 7.1 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection - [Joomla! Component vBizz 1.0.7 SQL Injection](https://agentprime.io/advisories/CVE-2019-25759.md) `CVE-2019-25759` · CVE record: Wdmtech vBizz · CVSS 7.1 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection - [Joomla vWishlist 1.0.1 SQL Injection via vproductid Parameter](https://agentprime.io/advisories/CVE-2019-25757.md) `CVE-2019-25757` · CVE record: Wdmtech vWishlist · CVSS 7.1 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection - [Joomla! Component vAccount 2.0.2 SQL Injection via vaccount-dashboard](https://agentprime.io/advisories/CVE-2019-25756.md) `CVE-2019-25756` · CVE record: Wdmtech vAccount · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection - [Joomla vReview 1.9.11 SQL Injection via editReview](https://agentprime.io/advisories/CVE-2019-25755.md) `CVE-2019-25755` · CVE record: Wdmtech vReview · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection - [Joomla vRestaurant 1.9.4 SQL Injection via menu-listing-layout](https://agentprime.io/advisories/CVE-2019-25754.md) `CVE-2019-25754` · CVE record: Wdmtech vRestaurant · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection - [Joomla! Component VMap 1.9.6 SQL Injection via loadmarker](https://agentprime.io/advisories/CVE-2019-25753.md) `CVE-2019-25753` · CVE record: Wdmtech VMap · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection - [Joomla! Component J-BusinessDirectory 4.9.7 SQL Injection](https://agentprime.io/advisories/CVE-2019-25752.md) `CVE-2019-25752` · CVE record: Cmsjunkie J-BusinessDirectory · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection - [Joomla J-ClassifiedsManager 3.0.5 SQL Injection](https://agentprime.io/advisories/CVE-2019-25751.md) `CVE-2019-25751` · CVE record: Cmsjunkie ClassifiedsManager · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection - [Joomla J-MultipleHotelReservation 6.0.7 SQL Injection](https://agentprime.io/advisories/CVE-2019-25750.md) `CVE-2019-25750` · CVE record: Cmsjunkie MultipleHotelReservation · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection - [Joomla J-CruisePortal 6.0.4 SQL Injection via cruises](https://agentprime.io/advisories/CVE-2019-25749.md) `CVE-2019-25749` · CVE record: Cmsjunkie J-CruisePortal · CVSS 7.1 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection - [Joomla JHotelReservation 6.0.7 SQL Injection via search-hotels](https://agentprime.io/advisories/CVE-2019-25748.md) `CVE-2019-25748` · CVE record: Cmsjunkie JHotelReservation · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection - [Joomla! Component jCart for OpenCart 2.0 SQL Injection](https://agentprime.io/advisories/CVE-2017-20282.md) `CVE-2017-20282` · CVE record: Soft-Php jCart for OpenCart · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection - [Joomla! Component Extra Search 2.2.8 SQL Injection](https://agentprime.io/advisories/CVE-2017-20281.md) `CVE-2017-20281` · CVE record: Joomlaboat Extra Search · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection - [Joomla Component Myportfolio 3.0.2 SQL Injection via pid Parameter](https://agentprime.io/advisories/CVE-2017-20280.md) `CVE-2017-20280` · CVE record: Myportfolio Myportfolio · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection - [Joomla Payage 2.05 SQL Injection via aid Parameter](https://agentprime.io/advisories/CVE-2017-20279.md) `CVE-2017-20279` · CVE record: Extensions Joomla Payage · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .