# SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [llama-index-packs-finchat SQL Injection vulnerability](https://agentprime.io/advisories/GHSA-x48g-hm9c-ww42.md)
  `GHSA-x48g-hm9c-ww42`, `CVE-2024-12909`, `PYSEC-2026-398` · PyPI `llama-index-packs-finchat`: affected `<=0.3.0`, no fixed version yet · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: SQL injection
- [code-projects Real State Services single-list_sale.php add sql injection](https://agentprime.io/advisories/CVE-2026-13559.md)
  `CVE-2026-13559` · CVE record: code-projects Real State Services · CVSS 6.9 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [itsourcecode Online Hotel Management System controller.php add sql injection](https://agentprime.io/advisories/CVE-2026-13555.md)
  `CVE-2026-13555` · CVE record: itsourcecode Online Hotel Management System · CVSS 6.9 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [itsourcecode Online Hotel Management System controller.php edit sql injection](https://agentprime.io/advisories/CVE-2026-13552.md)
  `CVE-2026-13552` · CVE record: itsourcecode Online Hotel Management System · CVSS 6.9 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [itsourcecode Baptism Information Management System editBaptism.php sql injection](https://agentprime.io/advisories/CVE-2026-13551.md)
  `CVE-2026-13551` · CVE record: itsourcecode Baptism Information Management System · CVSS 6.9 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [itsourcecode Baptism Information Management System delbaptism.php sql injection](https://agentprime.io/advisories/CVE-2026-13550.md)
  `CVE-2026-13550` · CVE record: itsourcecode Baptism Information Management System · CVSS 6.9 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System doctortimings.php sql injection](https://agentprime.io/advisories/CVE-2026-13548.md)
  `CVE-2026-13548` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System doctorprofile.php sql injection](https://agentprime.io/advisories/CVE-2026-13542.md)
  `CVE-2026-13542` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System doctorchangepassword.php sql injection](https://agentprime.io/advisories/CVE-2026-13541.md)
  `CVE-2026-13541` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [CodeAstro Human Resource Management System View Endpoint Employee_model.php GetFileInfo sql injection](https://agentprime.io/advisories/CVE-2026-13535.md)
  `CVE-2026-13535` · CVE record: CodeAstro Human Resource Management System · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System departmentDoctor.php sql injection](https://agentprime.io/advisories/CVE-2026-13532.md)
  `CVE-2026-13532` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System department.php sql injection](https://agentprime.io/advisories/CVE-2026-13531.md)
  `CVE-2026-13531` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System Appointment appointmentdetail.php sql injection](https://agentprime.io/advisories/CVE-2026-13530.md)
  `CVE-2026-13530` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [YzmCMS index.php sql injection](https://agentprime.io/advisories/CVE-2026-13529.md)
  `CVE-2026-13529` · CVE record: YzmCMS · CVSS 6.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [SourceCodester Class and Exam Timetabling System preview4.php sql injection](https://agentprime.io/advisories/CVE-2026-13527.md)
  `CVE-2026-13527` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [SourceCodester Class and Exam Timetabling System edit_class.php sql injection](https://agentprime.io/advisories/CVE-2026-13526.md)
  `CVE-2026-13526` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [CodeAstro Human Resource Management System Update_Earn_Leave Endpoint Employee_model.php emselectByCode sql injection](https://agentprime.io/advisories/CVE-2026-13525.md)
  `CVE-2026-13525` · CVE record: CodeAstro Human Resource Management System · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [SourceCodester Class and Exam Timetabling System preview5.php sql injection](https://agentprime.io/advisories/CVE-2026-13521.md)
  `CVE-2026-13521` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System Appointment appointmentapproval.php sql injection](https://agentprime.io/advisories/CVE-2026-13520.md)
  `CVE-2026-13520` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [Joomla Extension - joomcoder.com - Unauthenticated SQL Injection in JoomCCK extension for Joomla < 6.4.1](https://agentprime.io/advisories/CVE-2026-49048.md)
  `CVE-2026-49048` · CVE record: joomcoder.com JoomCCK extension for Joomla · CVSS 8.7 High · Not analysed yet · Published 28 Jun 2026 · Tags: SQL injection
- [yashpokharna2555 restaurent-management-system POST Parameter forgotpassword.php sql injection](https://agentprime.io/advisories/CVE-2026-13498.md)
  `CVE-2026-13498` · CVE record: yashpokharna2555 restaurent-management-system · CVSS 6.9 Medium · Not analysed yet · Published 28 Jun 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System appointment.php sql injection](https://agentprime.io/advisories/CVE-2026-13497.md)
  `CVE-2026-13497` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 28 Jun 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System ajaxmedicine.php sql injection](https://agentprime.io/advisories/CVE-2026-13496.md)
  `CVE-2026-13496` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 28 Jun 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System adminprofile.php sql injection](https://agentprime.io/advisories/CVE-2026-13495.md)
  `CVE-2026-13495` · CVE record: itsourcecode Hospital Management System · CVSS 5.1 Medium · Not analysed yet · Published 28 Jun 2026 · Tags: Other injection, SQL injection
- [SourceCodester Class and Exam Timetabling System preview7.php sql injection](https://agentprime.io/advisories/CVE-2026-13488.md)
  `CVE-2026-13488` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 28 Jun 2026 · Tags: Other injection, SQL injection
- [SourceCodester Class and Exam Timetabling System archive.php sql injection](https://agentprime.io/advisories/CVE-2026-13487.md)
  `CVE-2026-13487` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 28 Jun 2026 · Tags: Other injection, SQL injection
- [SourceCodester Class and Exam Timetabling System preview6.php sql injection](https://agentprime.io/advisories/CVE-2026-13486.md)
  `CVE-2026-13486` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 28 Jun 2026 · Tags: Other injection, SQL injection
- [SourceCodester Class and Exam Timetabling System preview.php sql injection](https://agentprime.io/advisories/CVE-2026-13485.md)
  `CVE-2026-13485` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 28 Jun 2026 · Tags: Other injection, SQL injection
- [Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query\[select\]' Parameter](https://agentprime.io/advisories/CVE-2026-13333.md)
  `CVE-2026-13333` · CVE record: trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation · CVSS 6.5 Medium · Not analysed yet · Published 27 Jun 2026 · Tags: SQL injection
- [Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter](https://agentprime.io/advisories/CVE-2026-13331.md)
  `CVE-2026-13331` · CVE record: trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation · CVSS 6.5 Medium · Not analysed yet · Published 27 Jun 2026 · Tags: SQL injection
- [OpenProject: SQL injection in timestamps functionality](https://agentprime.io/advisories/CVE-2026-52785.md)
  `CVE-2026-52785` · CVE record: opf openproject · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [WordPress Groundhogg plugin <= 4.5 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57667.md)
  `CVE-2026-57667` · CVE record: Adrian Tobey Groundhogg · CVSS 8.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [WordPress Recipe Maker For Your Food Blog from Zip Recipes plugin <= 8.2.7 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57663.md)
  `CVE-2026-57663` · CVE record: Igor Benic Recipe Maker For Your Food Blog from Zip Recipes · CVSS 8.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [WordPress Contest Gallery plugin <= 30.0.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57662.md)
  `CVE-2026-57662` · CVE record: Wasiliy Strecker Contest Gallery · CVSS 8.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [WordPress WP Job Portal plugin <= 2.5.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57653.md)
  `CVE-2026-57653` · CVE record: wpjobportal WP Job Portal · CVSS 8.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [WordPress Restaurant Menu by MotoPress plugin <= 2.4.10 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57644.md)
  `CVE-2026-57644` · CVE record: jetmonsters Restaurant Menu by MotoPress · CVSS 8.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [WordPress WP Post Author plugin <= 3.9.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57643.md)
  `CVE-2026-57643` · CVE record: AF themes WP Post Author · CVSS 8.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [WordPress Gallery plugin <= 4.7.8 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57642.md)
  `CVE-2026-57642` · CVE record: bestwebsoft Gallery · CVSS 8.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [WordPress wpForo Forum plugin <= 3.0.9 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57636.md)
  `CVE-2026-57636` · CVE record: Tomdever wpForo Forum · CVSS 8.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [WordPress Popup box plugin <= 6.0.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57631.md)
  `CVE-2026-57631` · CVE record: Ays Pro Popup box · CVSS 7.6 High · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [WordPress WP All Import plugin <= 4.0.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57628.md)
  `CVE-2026-57628` · CVE record: WP All Import WP All Import · CVSS 7.6 High · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [WordPress Advance Product Search plugin <= 1.4.4 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-56070.md)
  `CVE-2026-56070` · CVE record: ThemeHunk Advance Product Search · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [WordPress JetEngine plugin <= 3.8.10.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-56068.md)
  `CVE-2026-56068` · CVE record: Crocoblock. Jetimpex Inc. JetEngine · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [WordPress JetSmartFilters plugin <= 3.8.3 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-56067.md)
  `CVE-2026-56067` · CVE record: Crocoblock. Jetimpex Inc. JetSmartFilters · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [WordPress Tourfic plugin <= 2.22.5 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-56064.md)
  `CVE-2026-56064` · CVE record: Themefic Tourfic · CVSS 8.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [WordPress Quotes llama plugin <= 3.1.5 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-56062.md)
  `CVE-2026-56062` · CVE record: oooorgle Quotes llama · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [WordPress 워드프레스 결제 심플페이 plugin <= 5.5.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-56036.md)
  `CVE-2026-56036` · CVE record: codemstory 워드프레스 결제 심플페이 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [WordPress Library Management System plugin <= 3.5.7 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-56034.md)
  `CVE-2026-56034` · CVE record: Online Web Tutor Library Management System · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [WordPress GeoDirectory plugin <= 2.8.162 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54831.md)
  `CVE-2026-54831` · CVE record: AyeCode Ltd GeoDirectory · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [WordPress Real Estate 7 theme <= 3.5.9 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54827.md)
  `CVE-2026-54827` · CVE record: contempoinc Real Estate 7 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [WordPress wpDataTables plugin <= 7.4 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54825.md)
  `CVE-2026-54825` · CVE record: TMS wpDataTables · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [WordPress JetBooking plugin <= 4.0.4.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54820.md)
  `CVE-2026-54820` · CVE record: Crocoblock. Jetimpex Inc. JetBooking · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter](https://agentprime.io/advisories/CVE-2026-13226.md)
  `CVE-2026-13226` · CVE record: trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation · CVSS 6.5 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection
- [Cacti: SQL Injection in managers.php](https://agentprime.io/advisories/CVE-2026-40083.md)
  `CVE-2026-40083` · CVE record: Cacti cacti · CVSS 7.2 High · Not analysed yet · Published 25 Jun 2026 · Tags: SQL injection
- [SQL Injection in Nessus via Malicious Scan Result File Import](https://agentprime.io/advisories/CVE-2026-57588.md)
  `CVE-2026-57588` · CVE record: tenable Nessus · CVSS 1.6 Low · Not analysed yet · Published 25 Jun 2026 · Tags: SQL injection
- [SQL Injection in Nessus via Reverse DNS Lookup](https://agentprime.io/advisories/CVE-2026-57587.md)
  `CVE-2026-57587` · CVE record: tenable Nessus · CVSS 2.1 Low · Not analysed yet · Published 25 Jun 2026 · Tags: SQL injection
- [WordPress WP Photo Album Plus plugin <= 9.1.13.005 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54829.md)
  `CVE-2026-54829` · CVE record: Jacob N. Breetvelt WP Photo Album Plus · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: SQL injection
- [WordPress Filter & Grids plugin <= 3.11.5 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54836.md)
  `CVE-2026-54836` · CVE record: YMC YMC Filter · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Jun 2026 · Tags: SQL injection
- [WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.11 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54849.md)
  `CVE-2026-54849` · CVE record: Premmerce Premmerce Wishlist for WooCommerce · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Jun 2026 · Tags: SQL injection
- [WordPress MDTF plugin <= 1.3.7 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54843.md)
  `CVE-2026-54843` · CVE record: PluginUs.Net MDTF · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Jun 2026 · Tags: SQL injection

Newest: <https://agentprime.io/advisories/tag/sql-injection.md>
Older: <https://agentprime.io/advisories/tag/sql-injection.md?cursor=WyIyMDI2LTA2LTI1VDEzOjEyOjM0Ljg5MzAwMFoiLCJDVkUtMjAyNi01NDg0MyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=sql-injection&cursor=WyIyMDI2LTA2LTI5VDExOjUwOjQzLjgyOTQ0MloiLCJHSFNBLXZnaG0tOGNqcC1oanc2Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/sql-injection/?cursor=WyIyMDI2LTA2LTI5VDExOjUwOjQzLjgyOTQ0MloiLCJHSFNBLXZnaG0tOGNqcC1oanc2Il0>. Everything for agents: <https://agentprime.io/llms.txt>.