# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Authenticated SQL Injection in PHP Jabbers scripts](https://agentprime.io/advisories/CVE-2025-67650.md) `CVE-2025-67650` · CVE record: PHP Jabbers Appointment Scheduler and 4 more · CVSS 8.6 High · Not analysed yet · Published 31 Jul 2026 · Tags: SQL injection - [Unauthenticated SQL Injection in PHP Jabbers - Car Rental Script script](https://agentprime.io/advisories/CVE-2025-67649.md) `CVE-2025-67649` · CVE record: PHP Jabbers Car Rental Script · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Jul 2026 · Tags: SQL injection - [Kirki < 6.0.13 - Unauthenticated SQL Injection](https://agentprime.io/advisories/CVE-2026-12721.md) `CVE-2026-12721` · CVE record: Unknown Kirki · CVSS 8.6 High · Not analysed yet · Published 31 Jul 2026 · Tags: SQL injection - [WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter](https://agentprime.io/advisories/CVE-2026-15381.md) `CVE-2026-15381` · CVE record: Unknown WP Go Maps · CVSS 3.7 Low · Not analysed yet · Published 31 Jul 2026 · Tags: SQL injection - [Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter](https://agentprime.io/advisories/CVE-2026-15258.md) `CVE-2026-15258` · CVE record: Unknown Product Feed Manager For WooCommerce · CVSS 8.1 High · Not analysed yet · Published 31 Jul 2026 · Tags: SQL injection - [Check & Log Email < 2.0.15 - Admin+ SQL Injection via d and s Parameters](https://agentprime.io/advisories/CVE-2026-14554.md) `CVE-2026-14554` · CVE record: Unknown Check & Log Email · CVSS 6.5 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: SQL injection - [SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1.](https://agentprime.io/advisories/CVE-2025-69948.md) `CVE-2025-69948` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Jul 2026 · Tags: SQL injection - [SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters district_id , division_id, region_id, and ward_id.](https://agentprime.io/advisories/CVE-2025-69946.md) `CVE-2025-69946` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Jul 2026 · Tags: SQL injection - [Kamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers](https://agentprime.io/advisories/CVE-2026-62845.md) `CVE-2026-62845` · CVE record: clastix kamaji · CVSS 4.7 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [SQLi in UMAI Vision's Traffic Analysis System](https://agentprime.io/advisories/CVE-2026-4978.md) `CVE-2026-4978` · CVE record: UMAI Vision Traffic Analysis System · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [CentreStack < 17.4 SQL Injection via x-glad-filter Header](https://agentprime.io/advisories/CVE-2026-54368.md) `CVE-2026-54368` · CVE record: Gladinet CentreStack · CVSS 8.7 High · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [SQL injection in ext-pgsql via E'...' backslash breakout](https://agentprime.io/advisories/CVE-2026-17543.md) `CVE-2026-17543` · CVE record: PHP Group PHP · CVSS 8.1 High · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [SQL injection in Eaton PADM](https://agentprime.io/advisories/CVE-2026-22620.md) `CVE-2026-22620` · CVE record: Eaton PADM · CVSS 8.6 High · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [SQL injection in WebPros Plesk](https://agentprime.io/advisories/CVE-2026-58046.md) `CVE-2026-58046` · CVE record: WebPros Plesk · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [Bookly < 27.8 - Unauthenticated SQL Injection via staff_id](https://agentprime.io/advisories/CVE-2026-13395.md) `CVE-2026-13395` · CVE record: Unknown Online Scheduling and Appointment Booking System · CVSS 8.6 High · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search](https://agentprime.io/advisories/CVE-2026-15153.md) `CVE-2026-15153` · CVE record: Unknown WP Hotel Booking · CVSS 6.8 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [Improved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter](https://agentprime.io/advisories/CVE-2026-16092.md) `CVE-2026-16092` · CVE record: labelblanc Improved Save Button · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-48448.md) `CVE-2026-48448` · CVE record: Adobe Adobe Campaign Classic · CVSS 8.6 High · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [SQL injection in LG Electronics SmartShare](https://agentprime.io/advisories/CVE-2026-15929.md) `CVE-2026-15929` · CVE record: LG Electronics SmartShare · CVSS 7.1 High · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.](https://agentprime.io/advisories/CVE-2025-69947.md) `CVE-2025-69947` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1.](https://agentprime.io/advisories/CVE-2025-69941.md) `CVE-2025-69941` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.](https://agentprime.io/advisories/CVE-2025-69938.md) `CVE-2025-69938` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.](https://agentprime.io/advisories/CVE-2025-69937.md) `CVE-2025-69937` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.](https://agentprime.io/advisories/CVE-2025-69936.md) `CVE-2025-69936` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.](https://agentprime.io/advisories/CVE-2025-69935.md) `CVE-2025-69935` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1.](https://agentprime.io/advisories/CVE-2025-69934.md) `CVE-2025-69934` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1.](https://agentprime.io/advisories/CVE-2025-69933.md) `CVE-2025-69933` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1.](https://agentprime.io/advisories/CVE-2025-69931.md) `CVE-2025-69931` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1.](https://agentprime.io/advisories/CVE-2025-69930.md) `CVE-2025-69930` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php.](https://agentprime.io/advisories/CVE-2025-65336.md) `CVE-2025-65336` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection - [DriveLock SQL Injection Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2026-5490.md) `CVE-2026-5490` · CVE record: DriveLock DriveLock · CVSS 8.8 High · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [SQL Injection in Coverity Connect SOAP API](https://agentprime.io/advisories/CVE-2026-8339.md) `CVE-2026-8339` · CVE record: Black Duck Coverity Connect · CVSS 8.7 High · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2](https://agentprime.io/advisories/CVE-2026-65890.md) `CVE-2026-65890` · CVE record: balbooa.com Gridbox extension for Joomla · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [Blind SQL Injection in Quick.CMS](https://agentprime.io/advisories/CVE-2026-33385.md) `CVE-2026-33385` · CVE record: OpenSolution Quick.CMS · CVSS 5.1 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [SQL Injection in Frappe's ERPNext](https://agentprime.io/advisories/CVE-2026-12895.md) `CVE-2026-12895` · CVE record: Frappe ERPNext · CVSS 7.1 High · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [WP-Lister Lite for eBay <= 3.8.8 - Authenticated (Shop Manager+) SQL Injection via 'orderby' Parameter](https://agentprime.io/advisories/CVE-2026-11973.md) `CVE-2026-11973` · CVE record: wp-lab WP-Lister Lite for eBay · CVSS 4.9 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [SQL injection and unsafe deserialisation vulnerability](https://agentprime.io/advisories/CVE-2026-63234.md) `CVE-2026-63234` · CVE record: Three Learning Koollab LMS · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [SQL injection and unsafe deserialisation vulnerability](https://agentprime.io/advisories/CVE-2026-63233.md) `CVE-2026-63233` · CVE record: Three Learning Koollab LMS · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [SQL injection and unsafe deserialisation vulnerability](https://agentprime.io/advisories/CVE-2026-63232.md) `CVE-2026-63232` · CVE record: Three Learning Koollab LMS · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [Post-authentication SQL injection vulnerability](https://agentprime.io/advisories/CVE-2026-63231.md) `CVE-2026-63231` · CVE record: Three Learning Koollab LMS · CVSS 8.1 High · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [Pre-authentication error-based SQL injection vulnerability](https://agentprime.io/advisories/CVE-2026-63230.md) `CVE-2026-63230` · CVE record: Three Learning Koollab LMS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [Pre-authentication blind SQL injection vulnerability](https://agentprime.io/advisories/CVE-2026-63229.md) `CVE-2026-63229` · CVE record: Three Learning Koollab LMS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter](https://agentprime.io/advisories/CVE-2026-15344.md) `CVE-2026-15344` · CVE record: opajaap WP Photo Album Plus · CVSS 4.9 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php via the parameters emailid and email.](https://agentprime.io/advisories/CVE-2025-69949.md) `CVE-2025-69949` · CVE record · CVSS 7.3 High · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1.](https://agentprime.io/advisories/CVE-2025-69945.md) `CVE-2025-69945` · CVE record · CVSS 7.3 High · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory.php endpoint via the viewid parameter.](https://agentprime.io/advisories/CVE-2025-69944.md) `CVE-2025-69944` · CVE record · CVSS 7.3 High · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get_doctor.php via the parameters doctor and specilizationid.](https://agentprime.io/advisories/CVE-2025-69943.md) `CVE-2025-69943` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1.](https://agentprime.io/advisories/CVE-2025-69942.md) `CVE-2025-69942` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_user.php via the parameter status.](https://agentprime.io/advisories/CVE-2025-67408.md) `CVE-2025-67408` · CVE record · CVSS 7.3 High · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_student.php via parameters fname and student_class.](https://agentprime.io/advisories/CVE-2025-67407.md) `CVE-2025-67407` · CVE record · CVSS 7.3 High · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [https\://www\.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection.](https://agentprime.io/advisories/CVE-2025-67406.md) `CVE-2025-67406` · CVE record · CVSS 7.3 High · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_password.php via the parameter new_password.](https://agentprime.io/advisories/CVE-2025-67405.md) `CVE-2025-67405` · CVE record · CVSS 7.3 High · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud.php via the parameters fname, lname, and student_class.](https://agentprime.io/advisories/CVE-2025-67404.md) `CVE-2025-67404` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_class.php via the parameter class_name.](https://agentprime.io/advisories/CVE-2025-67403.md) `CVE-2025-67403` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php.](https://agentprime.io/advisories/CVE-2025-65340.md) `CVE-2025-65340` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection - [@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution](https://agentprime.io/advisories/GHSA-6wcc-39rp-hh9p.md) `GHSA-6wcc-39rp-hh9p`, `CVE-2026-54658` · npm `@hypequery/clickhouse`: affected `<2.5.1`, fixed in `2.5.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jul 2026 · Tags: SQL injection - [Authenticated SQL Injection Enables Unauthorized Access to Sensitive Information in Ellucian Advance Web and Legacy Advance](https://agentprime.io/advisories/CVE-2026-6881.md) `CVE-2026-6881` · CVE record: Ellucian Advance Web and 1 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jul 2026 · Tags: SQL injection - [Tanium addressed a SQL injection vulnerability in Patch.](https://agentprime.io/advisories/CVE-2026-11391.md) `CVE-2026-11391` · CVE record: Tanium Patch · CVSS 6.3 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: SQL injection - [Plugin Organizer <= 10.2.4 - Authenticated (Subscriber+) SQL Injection](https://agentprime.io/advisories/CVE-2026-15304.md) `CVE-2026-15304` · CVE record: foomagoo Plugin Organizer · CVSS 6.5 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: SQL injection - [SQL injection Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway](https://agentprime.io/advisories/CVE-2026-7769.md) `CVE-2026-7769` · CVE record: IBM Sterling B2B Integrator and 1 more · CVSS 8.1 High · Not analysed yet · Published 28 Jul 2026 · Tags: SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .