# SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Mautic has SQL Injection in API Contact Filtering](https://agentprime.io/advisories/GHSA-fcmw-wx57-9p75.md)
  `GHSA-fcmw-wx57-9p75`, `CVE-2026-4776`, `PKSA-pdn1-217f-vc3y` · Packagist `mautic/core`: affected `>=2.6.0, <=4.4.13 || >=5.0.0, <5.2.11 || >=6.0.0, <6.0.9 || >=7.0.0, <7.1.2`, fixed in `5.2.11`, `6.0.9`, `7.1.2` · CVSS 7.1 High · Not analysed yet · Published 2 Jul 2026 · Tags: SQL injection
- [Langroid: SQLChatAgent \_validate_query blocklist misses pg_read_file family enabling arbitrary file read](https://agentprime.io/advisories/GHSA-pmch-g965-grmr.md)
  `GHSA-pmch-g965-grmr`, `CVE-2026-50180`, `PYSEC-2026-2580` · PyPI `langroid`: affected `<0.64.0`, fixed in `0.64.0` · CVSS 8.7 High · Not analysed yet · Published 2 Jul 2026 · Tags: Path traversal, SQL injection
- [Landray OA Unauthenticated HQL Injection via wechatLoginHelper.do](https://agentprime.io/advisories/CVE-2024-58352.md)
  `CVE-2024-58352` · CVE record: Shenzhen Landray Software Co., Ltd. Landry Office Automation (OA) · CVSS 8.7 High · Not analysed yet · Published 2 Jul 2026 · Tags: SQL injection
- [SQL injection in Ubiquiti Inc UniFi Protect Application](https://agentprime.io/advisories/CVE-2026-56841.md)
  `CVE-2026-56841` · CVE record: Ubiquiti Inc UniFi Protect Application · CVSS 8.8 High · Not analysed yet · Published 2 Jul 2026 · Tags: SQL injection
- [SQL injection in Ubiquiti Inc UniFi Talk Application](https://agentprime.io/advisories/CVE-2026-50747.md)
  `CVE-2026-50747` · CVE record: Ubiquiti Inc UniFi Talk Application · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jul 2026 · Tags: SQL injection
- [SQL injection in Ubiquiti Inc UniFi OS Server and others](https://agentprime.io/advisories/CVE-2026-54404.md)
  `CVE-2026-54404` · CVE record: Ubiquiti Inc UniFi OS Server and 4 more · CVSS 8.8 High · Not analysed yet · Published 2 Jul 2026 · Tags: SQL injection
- [Possibility of unintended database operations when querying data related to detected anomalies in Progress Flowmon ADS](https://agentprime.io/advisories/CVE-2026-9272.md)
  `CVE-2026-9272` · CVE record: Progress Software Flowmon ADS · CVSS 8.7 High · Not analysed yet · Published 2 Jul 2026 · Tags: SQL injection
- [WordPress WP EasyCart plugin <= 5.9.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57765.md)
  `CVE-2026-57765` · CVE record: Levelfourdevelopment WP EasyCart · CVSS 8.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: SQL injection
- [WordPress nicen-localize-image plugin <= 1.4.9 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57756.md)
  `CVE-2026-57756` · CVE record: 友人a丶 nicen-localize-image · CVSS 8.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: SQL injection
- [WordPress iNET Webkit plugin 1.2.4 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57752.md)
  `CVE-2026-57752` · CVE record: iNET iNET Webkit · CVSS 8.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: SQL injection
- [WordPress Custom Field Template plugin <= 2.7.8 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57687.md)
  `CVE-2026-57687` · CVE record: Hiroaki Miyashita Custom Field Template · CVSS 8.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: SQL injection
- [WordPress WP Fast Total Search plugin <= 1.80.280 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57683.md)
  `CVE-2026-57683` · CVE record: Epsiloncool WP Fast Total Search · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jul 2026 · Tags: SQL injection
- [WordPress GeekyBot plugin <= 1.2.5 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57679.md)
  `CVE-2026-57679` · CVE record: Ahmadgb GeekyBot · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jul 2026 · Tags: SQL injection
- [WordPress Unicamp theme <= 2.2.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2025-69094.md)
  `CVE-2025-69094` · CVE record: ThemeMove Unicamp · CVSS 8.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: SQL injection
- [WP Review Slider Pro <= 12.7.2 - Unauthenticated SQL Injection via 'notinstring' Parameter](https://agentprime.io/advisories/CVE-2026-8441.md)
  `CVE-2026-8441` · CVE record: https\://wpreviewslider.com/ WP Review Slider Pro · CVSS 7.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: SQL injection
- [Groundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' Parameter](https://agentprime.io/advisories/CVE-2026-14029.md)
  `CVE-2026-14029` · CVE record: trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation · CVSS 6.5 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: SQL injection
- [Houzez Property Feed <= 2.5.46 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter](https://agentprime.io/advisories/CVE-2026-13357.md)
  `CVE-2026-13357` · CVE record: propertyhive Houzez Property Feed · CVSS 4.9 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: SQL injection
- [Cargo Extension: SQLi in Special:Drilldown](https://agentprime.io/advisories/CVE-2026-14363.md)
  `CVE-2026-14363` · CVE record: The Wikimedia Foundation Mediawiki - Cargo Extension · CVSS 6.9 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: SQL injection
- [SQLi in Cargo extension via year range filter](https://agentprime.io/advisories/CVE-2026-58521.md)
  `CVE-2026-58521` · CVE record: The Wikimedia Foundation Mediawiki - Cargo Extension · CVSS 6.9 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: SQL injection
- [Guardian Language-System SQL Injection via id Parameter in translate_text.php](https://agentprime.io/advisories/CVE-2026-34105.md)
  `CVE-2026-34105` · CVE record: guardian language-system · CVSS 8.7 High · Not analysed yet · Published 1 Jul 2026 · Tags: SQL injection
- [Guardian Language-System SQL Injection via name Parameter in designer.php](https://agentprime.io/advisories/CVE-2026-34104.md)
  `CVE-2026-34104` · CVE record: guardian language-system · CVSS 8.7 High · Not analysed yet · Published 1 Jul 2026 · Tags: SQL injection
- [Guardian Language-System SQL Injection via id Parameter in subtitles.php](https://agentprime.io/advisories/CVE-2026-34103.md)
  `CVE-2026-34103` · CVE record: guardian language-system · CVSS 8.7 High · Not analysed yet · Published 1 Jul 2026 · Tags: SQL injection
- [Guardian Language-System SQL Injection via id Parameter in job_info_get.php](https://agentprime.io/advisories/CVE-2026-34102.md)
  `CVE-2026-34102` · CVE record: guardian language-system · CVSS 8.7 High · Not analysed yet · Published 1 Jul 2026 · Tags: SQL injection
- [Guardian Language-System SQL Injection via id Parameter in text_file.php](https://agentprime.io/advisories/CVE-2026-34101.md)
  `CVE-2026-34101` · CVE record: guardian language-system · CVSS 8.7 High · Not analysed yet · Published 1 Jul 2026 · Tags: SQL injection
- [Guardian Language-System SQL Injection via id Parameter in media.php](https://agentprime.io/advisories/CVE-2026-34100.md)
  `CVE-2026-34100` · CVE record: guardian language-system · CVSS 8.7 High · Not analysed yet · Published 1 Jul 2026 · Tags: SQL injection
- [Guardian Language-System Unauthenticated SQL Injection via id Parameter in job_info.php](https://agentprime.io/advisories/CVE-2026-34099.md)
  `CVE-2026-34099` · CVE record: guardian language-system · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: SQL injection
- [Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter](https://agentprime.io/advisories/CVE-2026-57517.md)
  `CVE-2026-57517` · CVE record: Control Web Panel Control Web Panel · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: SQL injection
- [MotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameter](https://agentprime.io/advisories/CVE-2026-13454.md)
  `CVE-2026-13454` · CVE record: jetmonsters MotoPress Appointment Booking · CVSS 6.5 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: SQL injection
- [BookingPress Appointment Booking Pro <= 5.7.1 - Unauthenticated SQL Injection via 'store_service_date' Parameter](https://agentprime.io/advisories/CVE-2026-11823.md)
  `CVE-2026-11823` · CVE record: Repute Infosystems BookingPress Appointment Booking Pro · CVSS 7.5 High · Not analysed yet · Published 1 Jul 2026 · Tags: SQL injection
- [Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'wppm_proj_filter' Parameter](https://agentprime.io/advisories/CVE-2026-12090.md)
  `CVE-2026-12090` · CVE record: taskbuilder Taskbuilder – Project Management & Task Management Tool With Kanban Board · CVSS 6.5 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: SQL injection
- [Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter](https://agentprime.io/advisories/CVE-2026-12110.md)
  `CVE-2026-12110` · CVE record: taskbuilder Taskbuilder – Project Management & Task Management Tool With Kanban Board · CVSS 6.5 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: SQL injection
- [SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to execute arbitrary code via the gohead/sub_463bbc component](https://agentprime.io/advisories/CVE-2026-52186.md)
  `CVE-2026-52186` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: SQL injection
- [SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) allows a remote attacker to execute arbitrary code and obtain sensitive information via the the \_\_sort_type URL parameter on…](https://agentprime.io/advisories/CVE-2026-51946.md)
  `CVE-2026-51946` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: SQL injection
- [SQL Injection in StoneFly Storage Concentrator](https://agentprime.io/advisories/CVE-2026-55721.md)
  `CVE-2026-55721` · CVE record: StoneFly Storage Concentrator and 1 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: SQL injection
- [Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints](https://agentprime.io/advisories/CVE-2026-58376.md)
  `CVE-2026-58376` · CVE record: Dolibarr dolibarr · CVSS 7.2 High · Not analysed yet · Published 30 Jun 2026 · Tags: SQL injection
- [Apache Gravitino JDBC configuration validation bypass can allow file reads or truncation](https://agentprime.io/advisories/GHSA-7ph3-grqh-pv9v.md)
  `GHSA-7ph3-grqh-pv9v`, `CVE-2025-53648` · Maven `org.apache.gravitino:catalog-jdbc-common`: affected `>=0.5.0, <1.0.0`, fixed in `1.0.0` · CVSS 5.4 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: SQL injection
- [SQLi in Exagate's SYSGUARD 6001](https://agentprime.io/advisories/CVE-2026-8402.md)
  `CVE-2026-8402` · CVE record: Eksagate Electronic Engineering and Computer Industry Trade Inc. SYSGUARD 6001 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: SQL injection
- [DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers](https://agentprime.io/advisories/CVE-2026-13766.md)
  `CVE-2026-13766` · CVE record: EXODIST DBIx::QuickORM · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: SQL injection
- [SQL Injection in Redeight CMS](https://agentprime.io/advisories/CVE-2026-53690.md)
  `CVE-2026-53690` · CVE record: Redeight Redeight CMS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: SQL injection
- [EventON - WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter](https://agentprime.io/advisories/CVE-2026-9711.md)
  `CVE-2026-9711` · CVE record: EventON EventON (Pro) - WordPress Virtual Event Calendar Plugin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: SQL injection
- [SQL Injection in Raytha CMS](https://agentprime.io/advisories/CVE-2026-12076.md)
  `CVE-2026-12076` · CVE record: Raytha Raytha · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: SQL injection
- [SigNoz 0.130.1 - SQL Injection in Alert History Endpoints via Rule ID Parameter](https://agentprime.io/advisories/CVE-2026-57955.md)
  `CVE-2026-57955` · CVE record: SigNoz signoz · CVSS 8.3 High · Not analysed yet · Published 29 Jun 2026 · Tags: SQL injection
- [Snowflake CLI SQL Injection Through Improper Neutralization of Parameters in Secret Creation and SPCS Service Log Commands](https://agentprime.io/advisories/CVE-2026-13752.md)
  `CVE-2026-13752` · CVE record: Snowflake Snowflake CLI · CVSS 6.0 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: SQL injection
- [Snowflake CLI SQL Injection Through Improper Neutralization of Local CLI Parameters](https://agentprime.io/advisories/CVE-2026-13746.md)
  `CVE-2026-13746` · CVE record: Snowflake Snowflake CLI · CVSS 3.6 Low · Not analysed yet · Published 29 Jun 2026 · Tags: SQL injection
- [Snowflake CLI SQL Injection Through Improper Neutralization of User-Controlled Input](https://agentprime.io/advisories/CVE-2026-13744.md)
  `CVE-2026-13744` · CVE record: Snowflake Snowflake CLI · CVSS 8.3 High · Not analysed yet · Published 29 Jun 2026 · Tags: SQL injection
- [itsourcecode Hospital Management System patientchangepassword.php sql injection](https://agentprime.io/advisories/CVE-2026-13579.md)
  `CVE-2026-13579` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System patientdetail.php sql injection](https://agentprime.io/advisories/CVE-2026-13578.md)
  `CVE-2026-13578` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System insertbillingrecord.php sql injection](https://agentprime.io/advisories/CVE-2026-13572.md)
  `CVE-2026-13572` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [weng-xianhu EyouCMS API index.php sql injection](https://agentprime.io/advisories/CVE-2026-13569.md)
  `CVE-2026-13569` · CVE record: weng-xianhu EyouCMS · CVSS 5.1 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [FrontAccounting < 2.4.20 SQL Injection via rep601.php](https://agentprime.io/advisories/CVE-2026-40522.md)
  `CVE-2026-40522` · CVE record: FrontAccounting FrontAccounting · CVSS 7.1 High · Not analysed yet · Published 29 Jun 2026 · Tags: SQL injection, Weak cryptography or TLS
- [FrontAccounting < 2.4.20 SQL Injection via reporting/rep710.php](https://agentprime.io/advisories/CVE-2026-40523.md)
  `CVE-2026-40523` · CVE record: FrontAccounting FrontAccounting · CVSS 7.2 High · Not analysed yet · Published 29 Jun 2026 · Tags: SQL injection
- [FrontAccounting < 2.4.20 SQL Injection via get_gl_transactions()](https://agentprime.io/advisories/CVE-2026-40524.md)
  `CVE-2026-40524` · CVE record: FrontAccounting FrontAccounting · CVSS 7.2 High · Not analysed yet · Published 29 Jun 2026 · Tags: SQL injection
- [SourceCodester Class and Exam Timetabling System preview3.php sql injection](https://agentprime.io/advisories/CVE-2026-13566.md)
  `CVE-2026-13566` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [SourceCodester Class and Exam Timetabling System edit_class1.php sql injection](https://agentprime.io/advisories/CVE-2026-13565.md)
  `CVE-2026-13565` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, SQL injection
- [ormar is vulnerable to SQL Injection through aggregate functions min() and max()](https://agentprime.io/advisories/GHSA-xxh2-68g9-8jqr.md)
  `GHSA-xxh2-68g9-8jqr`, `CVE-2026-26198`, `PYSEC-2026-439` · PyPI `ormar`: affected `>=0.9.9, <0.23.0`, fixed in `0.23.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: SQL injection
- [Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API](https://agentprime.io/advisories/GHSA-vjr5-c9qv-hgm3.md)
  `GHSA-vjr5-c9qv-hgm3`, `CVE-2026-29080`, `PYSEC-2026-528` · PyPI `rucio`: affected `>=1.27.0, <35.8.5 || >=36.0.0, <38.5.5 || >=39.0.0, <39.4.2 || >=40.0.0, <40.1.1`, fixed in `35.8.5`, `38.5.5`, `39.4.2`, `40.1.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: SQL injection
- [Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API](https://agentprime.io/advisories/GHSA-6j7p-qjhg-9947.md)
  `GHSA-6j7p-qjhg-9947`, `CVE-2026-29090`, `PYSEC-2026-527` · PyPI `rucio`: affected `>=1.30.0, <35.8.5 || >=36.0.0, <38.5.5 || >=39.0.0, <39.4.2 || >=40.0.0, <40.1.1`, fixed in `35.8.5`, `38.5.5`, `39.4.2`, `40.1.1` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: SQL injection
- [PraisonAI Has Second-Order SQL Injection in \`get_all_user_threads\`](https://agentprime.io/advisories/GHSA-9cq8-3v94-434g.md)
  `GHSA-9cq8-3v94-434g`, `CVE-2026-34934`, `PYSEC-2026-470` · PyPI `praisonai`: affected `<4.5.90`, fixed in `4.5.90` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: SQL injection
- [SciTokens is vulnerable to SQL Injection in KeyCache](https://agentprime.io/advisories/GHSA-rh5m-2482-966c.md)
  `GHSA-rh5m-2482-966c`, `CVE-2026-32714`, `PYSEC-2026-530` · PyPI `scitokens`: affected `<1.9.6`, fixed in `1.9.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: SQL injection
- [postgraas-server vulnerable to SQL injection](https://agentprime.io/advisories/GHSA-vghm-8cjp-hjw6.md)
  `GHSA-vghm-8cjp-hjw6`, `CVE-2018-25088`, `PYSEC-2026-460` · PyPI `postgraas-server`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 5.5 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: SQL injection

Newest: <https://agentprime.io/advisories/tag/sql-injection.md>
Older: <https://agentprime.io/advisories/tag/sql-injection.md?cursor=WyIyMDI2LTA2LTI5VDExOjUwOjQzLjgyOTQ0MloiLCJHSFNBLXZnaG0tOGNqcC1oanc2Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=sql-injection&cursor=WyIyMDI2LTA3LTAzVDAxOjI4OjIwLjAyMTAwMFoiLCJDVkUtMjAyNi0xMjkyMCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/sql-injection/?cursor=WyIyMDI2LTA3LTAzVDAxOjI4OjIwLjAyMTAwMFoiLCJDVkUtMjAyNi0xMjkyMCJd>. Everything for agents: <https://agentprime.io/llms.txt>.