# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances](https://agentprime.io/advisories/GHSA-jqwr-vx3p-r266.md) `GHSA-jqwr-vx3p-r266`, `CVE-2026-72775` · npm `n8n`: affected `<1.123.67 || >=2.0.0-rc.0, <2.31.5 || >=2.32.0, <2.32.1`, fixed in `1.123.67`, `2.31.5`, `2.32.1` · CVSS 5.8 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: SQL injection - [n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation](https://agentprime.io/advisories/GHSA-hwmj-qg4v-cvg9.md) `GHSA-hwmj-qg4v-cvg9`, `CVE-2026-59257` · npm `n8n`: affected `<1.123.61 || >=2.0.0-rc.0, <2.27.4 || >=2.28.0, <2.28.1`, fixed in `1.123.61`, `2.27.4`, `2.28.1` · CVSS 5.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: SQL injection - [SQLi in Xpoda Türkiye Informatics Technology's No Code Platform](https://agentprime.io/advisories/CVE-2026-2395.md) `CVE-2026-2395` · CVE record: Xpoda Türkiye Informatics Technology Inc. No Code Platform · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2026 · Tags: SQL injection - [Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration](https://agentprime.io/advisories/CVE-2026-12987.md) `CVE-2026-12987` · CVE record: Unknown Events Manager · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: SQL injection - [itsourcecode Hospital Management System prescription.php sql injection](https://agentprime.io/advisories/CVE-2026-16490.md) `CVE-2026-16490` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Other injection, SQL injection - [Improper access control in Oracle Corporation Oracle HCM Configuration Workbench](https://agentprime.io/advisories/CVE-2026-62528.md) `CVE-2026-62528` · CVE record: Oracle Corporation Oracle HCM Configuration Workbench · CVSS 6.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: SQL injection, Information disclosure, Broken access control - [Improper access control in Oracle Corporation Oracle Learning Management](https://agentprime.io/advisories/CVE-2026-62527.md) `CVE-2026-62527` · CVE record: Oracle Corporation Oracle Learning Management · CVSS 6.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: SQL injection, Information disclosure, Broken access control - [SQL injection in Oracle Corporation Oracle Demantra Demand Management](https://agentprime.io/advisories/CVE-2026-62516.md) `CVE-2026-62516` · CVE record: Oracle Corporation Oracle Demantra Demand Management · CVSS 8.8 High · Not analysed yet · Published 21 Jul 2026 · Tags: SQL injection, Broken access control - [Improper access control in Oracle Corporation Oracle Common Applications Calendar](https://agentprime.io/advisories/CVE-2026-61294.md) `CVE-2026-61294` · CVE record: Oracle Corporation Oracle Common Applications Calendar · CVSS 6.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: SQL injection, Information disclosure, Broken access control - [Improper access control in Oracle Corporation Oracle Supply Chain Globalization](https://agentprime.io/advisories/CVE-2026-61266.md) `CVE-2026-61266` · CVE record: Oracle Corporation Oracle Supply Chain Globalization · CVSS 6.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: SQL injection, Information disclosure, Broken access control - [Improper access control in Oracle Corporation Oracle Enterprise Command Center Framework](https://agentprime.io/advisories/CVE-2026-60582.md) `CVE-2026-60582` · CVE record: Oracle Corporation Oracle Enterprise Command Center Framework · CVSS 8.3 High · Not analysed yet · Published 21 Jul 2026 · Tags: SQL injection, Broken access control, Denial of service - [SourceCodester Class and Exam Timetabling System edit_subjecta.php sql injection](https://agentprime.io/advisories/CVE-2026-16484.md) `CVE-2026-16484` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Other injection, SQL injection - [Aptabase SQL Injection via ClickHouse query backend](https://agentprime.io/advisories/CVE-2026-63080.md) `CVE-2026-63080` · CVE record: aptabase aptabase · CVSS 7.1 High · Not analysed yet · Published 21 Jul 2026 · Tags: SQL injection - [Blind SQL Injection](https://agentprime.io/advisories/CVE-2026-64880.md) `CVE-2026-64880` · CVE record: Tenable, Inc. Security Center · CVSS 7.1 High · Not analysed yet · Published 21 Jul 2026 · Tags: SQL injection - [Linknat VOS3000/VOS2009 2.1.2.0 SQL Injection via login.jsp](https://agentprime.io/advisories/CVE-2016-20096.md) `CVE-2016-20096` · CVE record: Kunshi Network Technology Co., Ltd. Linknat VOS3000 and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: SQL injection - [DHIS2 SQL injection in SQL View filter values](https://agentprime.io/advisories/CVE-2026-55082.md) `CVE-2026-55082` · CVE record: dhis2 dhis2-core · CVSS 8.7 High · Not analysed yet · Published 21 Jul 2026 · Tags: SQL injection - [SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read](https://agentprime.io/advisories/CVE-2026-55084.md) `CVE-2026-55084` · CVE record: dhis2 dhis2-core · CVSS 8.8 High · Not analysed yet · Published 21 Jul 2026 · Tags: SQL injection - [SQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox](https://agentprime.io/advisories/CVE-2026-15829.md) `CVE-2026-15829` · CVE record: Google MCP Toolbox for Databases (googleapis/mcp-toolbox) · CVSS 8.6 High · Not analysed yet · Published 21 Jul 2026 · Tags: SQL injection, Broken access control - [zsadmin2025 ZS-Admin com.zs.sys.dept.controller.SysDeptController page OrderItem.desc sql injection](https://agentprime.io/advisories/CVE-2026-16449.md) `CVE-2026-16449` · CVE record: zsadmin2025 ZS-Admin · CVSS 5.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Other injection, SQL injection - [SQLi in Turkmesh's Turkhotspot 5651 Loglama](https://agentprime.io/advisories/CVE-2026-1617.md) `CVE-2026-1617` · CVE record: Turkmesh Communication Services Inc. Turkhotspot 5651 Loglama · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: SQL injection - [Bpost Shipping Platform < 3.2.3 - Unauthenticated SQL Injection](https://agentprime.io/advisories/CVE-2026-8082.md) `CVE-2026-8082` · CVE record: Unknown bpost-shipping-platform · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: SQL injection - [itsourcecode Hospital Management System prescriptionorder.php sql injection](https://agentprime.io/advisories/CVE-2026-16334.md) `CVE-2026-16334` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Other injection, SQL injection - [SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file](https://agentprime.io/advisories/CVE-2026-52476.md) `CVE-2026-52476` · CVE record · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: SQL injection - [SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file](https://agentprime.io/advisories/CVE-2026-52472.md) `CVE-2026-52472` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: SQL injection - [SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file](https://agentprime.io/advisories/CVE-2026-52470.md) `CVE-2026-52470` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: SQL injection - [SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file](https://agentprime.io/advisories/CVE-2026-52469.md) `CVE-2026-52469` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: SQL injection - [Apache Syncope: SQL injection vulnerability in Audit Events search](https://agentprime.io/advisories/CVE-2026-57308.md) `CVE-2026-57308` · CVE record: Apache Software Foundation Apache Syncope · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jul 2026 · Tags: SQL injection - [Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System Staffshinel Ds.jsp sql injection](https://agentprime.io/advisories/CVE-2026-16252.md) `CVE-2026-16252` · CVE record: Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System · CVSS 6.9 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Other injection, SQL injection - [Blind SQL Injection in Windu CMS](https://agentprime.io/advisories/CVE-2026-57309.md) `CVE-2026-57309` · CVE record: JCD Windu CMS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jul 2026 · Tags: SQL injection - [itsourcecode Hospital Management System prescriptionorderreport.php sql injection](https://agentprime.io/advisories/CVE-2026-16244.md) `CVE-2026-16244` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Other injection, SQL injection - [Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more](https://agentprime.io/advisories/CVE-2026-11349.md) `CVE-2026-11349` · CVE record: Unknown Modern Event Calendar Pro and 1 more · CVSS 8.6 High · Not analysed yet · Published 20 Jul 2026 · Tags: SQL injection - [SourceCodester Class and Exam Timetabling System edit_schoolyr.php sql injection](https://agentprime.io/advisories/CVE-2026-16228.md) `CVE-2026-16228` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 19 Jul 2026 · Tags: Other injection, SQL injection - [SourceCodester Class and Exam Timetabling System edit_subject.php sql injection](https://agentprime.io/advisories/CVE-2026-16227.md) `CVE-2026-16227` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 19 Jul 2026 · Tags: Other injection, SQL injection - [SourceCodester Class and Exam Timetabling System edit_room1.php sql injection](https://agentprime.io/advisories/CVE-2026-16154.md) `CVE-2026-16154` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 18 Jul 2026 · Tags: Other injection, SQL injection - [SourceCodester Class and Exam Timetabling System edit_rooma.php sql injection](https://agentprime.io/advisories/CVE-2026-16152.md) `CVE-2026-16152` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 18 Jul 2026 · Tags: Other injection, SQL injection - [itsourcecode Hospital Management System prescriptionrecord.php sql injection](https://agentprime.io/advisories/CVE-2026-16131.md) `CVE-2026-16131` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 18 Jul 2026 · Tags: Other injection, SQL injection - [WordPress < 7.0.2 - Facilitated SQL Injection via author\_\_not_in in WP_Query](https://agentprime.io/advisories/CVE-2026-60137.md) `CVE-2026-60137` · CVE record: WordPress WordPress · CVSS 5.9 Medium · Critical (KEV) · In CISA KEV · Not analysed yet · Published 17 Jul 2026 · Tags: SQL injection - [SQL injection in Amazon Athena Synapse connector](https://agentprime.io/advisories/CVE-2026-12283.md) `CVE-2026-12283` · CVE record: AWS aws-athena-query-federation · CVSS 6.1 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: SQL injection - [Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB](https://agentprime.io/advisories/CVE-2026-9586.md) `CVE-2026-9586` · CVE record: Sangoma Switchvox SMB Edition · CVSS 9.3 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.19 · Not analysed yet · Published 17 Jul 2026 · Tags: SQL injection - [SQLi in GIS Informatics' GisLab Laboratory Management System](https://agentprime.io/advisories/CVE-2026-8297.md) `CVE-2026-8297` · CVE record: Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jul 2026 · Tags: SQL injection - [code-projects Hospital Bed Management System Login Form sql injection](https://agentprime.io/advisories/CVE-2026-16014.md) `CVE-2026-16014` · CVE record: code-projects Hospital Bed Management System · CVSS 6.9 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Other injection, SQL injection - [itsourcecode Hospital Management System prescriptionorderdetail.php sql injection](https://agentprime.io/advisories/CVE-2026-16009.md) `CVE-2026-16009` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Other injection, SQL injection - [cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java.](https://agentprime.io/advisories/CVE-2026-52348.md) `CVE-2026-52348` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jul 2026 · Tags: SQL injection - [Booking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import](https://agentprime.io/advisories/CVE-2026-14782.md) `CVE-2026-14782` · CVE record: melograno Booking for Appointments and Events Calendar – Amelia · CVSS 4.9 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: SQL injection - [WP Bulk Delete <= 1.4.2 - Authenticated (Administrator+) SQL Injection via 'delete_user_roles' Parameter](https://agentprime.io/advisories/CVE-2026-15727.md) `CVE-2026-15727` · CVE record: xylus WP Bulk Delete · CVSS 4.9 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: SQL injection - [Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1](https://agentprime.io/advisories/CVE-2026-58078.md) `CVE-2026-58078` · CVE record: themexpert.com Quix Page Builder Pro extension for Joomla · CVSS 8.7 High · Not analysed yet · Published 16 Jul 2026 · Tags: SQL injection - [WP TripAdvisor Review Slider <= 14.6 - Authenticated (Administrator+) SQL Injection via 'filtersource' Parameter](https://agentprime.io/advisories/CVE-2026-15651.md) `CVE-2026-15651` · CVE record: jgwhite33 WP TripAdvisor Review Slider · CVSS 4.9 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: SQL injection - [Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array](https://agentprime.io/advisories/CVE-2026-15022.md) `CVE-2026-15022` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 6.5 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: SQL injection - [Tickera <= 3.6.0.0 - Authenticated (Staff+) SQL Injection via 's' Parameter](https://agentprime.io/advisories/CVE-2026-13754.md) `CVE-2026-13754` · CVE record: tickera Tickera – Sell Tickets & Manage Events · CVSS 6.5 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: SQL injection - [Quiz and Survey Master (QSM) <= 11.2.0 - Authenticated (Custom+) SQL Injection via 'pages' Parameter](https://agentprime.io/advisories/CVE-2026-13767.md) `CVE-2026-13767` · CVE record: expresstech Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker · CVSS 6.5 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: SQL injection - [WP Job Portal < 2.5.5 - Subscriber+ SQL Injection via Applied Resumes 'ta' Parameter](https://agentprime.io/advisories/CVE-2026-12395.md) `CVE-2026-12395` · CVE record: Unknown WP Job Portal · CVSS 6.5 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: SQL injection - [SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'sort_field' Parameter](https://agentprime.io/advisories/CVE-2026-15458.md) `CVE-2026-15458` · CVE record: cleverplugins SEO Booster · CVSS 4.9 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: SQL injection - [SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter](https://agentprime.io/advisories/CVE-2026-15445.md) `CVE-2026-15445` · CVE record: cleverplugins SEO Booster · CVSS 4.9 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: SQL injection - [MultiVendorX <= 5.0.9 - Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter](https://agentprime.io/advisories/CVE-2026-12941.md) `CVE-2026-12941` · CVE record: wcmp MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions · CVSS 6.5 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: SQL injection - [Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 - Unauthenticated SQL Injection via 's' and 'match' Parameter](https://agentprime.io/advisories/CVE-2026-12753.md) `CVE-2026-12753` · CVE record: themehunk Advance Product Search- Voice & Ajax Search for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 16 Jul 2026 · Tags: SQL injection - [A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to access sensitive database information via crafted SQL statements.](https://agentprime.io/advisories/CVE-2026-38158.md) `CVE-2026-38158` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jul 2026 · Tags: SQL injection - [LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to blind SQL injection in the ComparisonServlet component, allowing authenticated user to manipulate SQL queries via crafted input.](https://agentprime.io/advisories/CVE-2025-45868.md) `CVE-2025-45868` · CVE record · CVSS 8.8 High · Not analysed yet · Published 16 Jul 2026 · Tags: SQL injection - [H3C SecPath F1000-C8300 g=log_fw_nbc_mail_jsondata sql injection](https://agentprime.io/advisories/CVE-2026-15907.md) `CVE-2026-15907` · CVE record: H3C SecPath F1000-C8300 · CVSS 6.9 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Other injection, SQL injection - [DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injection](https://agentprime.io/advisories/CVE-2026-45320.md) `CVE-2026-45320` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 15 Jul 2026 · Tags: SQL injection - [DataEase: Stored SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-45535.md) `CVE-2026-45535` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 15 Jul 2026 · Tags: SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .