# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Miantang IoT-PHP - Unauthenticated SQL Injection in /userlogin](https://agentprime.io/advisories/CVE-2026-71237.md) `CVE-2026-71237` · CVE record: Miantang IoT-PHP · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection - [IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie](https://agentprime.io/advisories/CVE-2026-71231.md) `CVE-2026-71231` · CVE record: thebradleysanders IOTSmartHome · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection - [SQL Injection Vulnerability in ZTE SmartLife App](https://agentprime.io/advisories/CVE-2026-8029.md) `CVE-2026-8029` · CVE record: ZTE SmartLife · CVSS 3.9 Low · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection - [JoomSport <= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order' Parameter](https://agentprime.io/advisories/CVE-2026-11920.md) `CVE-2026-11920` · CVE record: beardev JoomSport – for Sports: Team & League, Football, Hockey & more · CVSS 4.9 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection - [WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection](https://agentprime.io/advisories/CVE-2026-11977.md) `CVE-2026-11977` · CVE record: afthemes WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection - [WP TripAdvisor Review Slider <= 14.3 - Authenticated (Administrator+) SQL Injection](https://agentprime.io/advisories/CVE-2026-11969.md) `CVE-2026-11969` · CVE record: jgwhite33 WP TripAdvisor Review Slider · CVSS 4.9 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection - [Stock-Inventory-Management-System - Unauthenticated SQL Injection and Hardcoded Credentials in login.php Enable Full Authentication Bypass](https://agentprime.io/advisories/CVE-2026-71207.md) `CVE-2026-71207` · CVE record: mrswapnilsahu Stock-Inventory-Management-System · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection - [Askeet <= 3.0 - Authenticated (Administrator+) SQL Injection via 'sql_query' Parameter](https://agentprime.io/advisories/CVE-2026-5651.md) `CVE-2026-5651` · CVE record: 2wstechnologies Askeet — Talk to Your WooCommerce Data · CVSS 4.9 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection - [TableOn <= 1.0.5.1 - Unauthenticated Blind SQL Injection via 'comment_count' Filter Parameter](https://agentprime.io/advisories/CVE-2026-18881.md) `CVE-2026-18881` · CVE record: realmag777 TableOn – WordPress Posts Table Filterable · CVSS 7.5 High · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection - [User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection](https://agentprime.io/advisories/CVE-2026-15281.md) `CVE-2026-15281` · CVE record: gm_alex User Access Manager · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection - [PostgreSQL Misconfiguration and Command Injection Vulnerability in ZTE NX799J (Red Magic 11 Air) Product](https://agentprime.io/advisories/CVE-2026-49004.md) `CVE-2026-49004` · CVE record: ZTE NX799J (Red Magic 11 Air) · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection - [Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args](https://agentprime.io/advisories/CVE-2026-15360.md) `CVE-2026-15360` · CVE record: Unknown Ajax Load More · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection - [PrettyLinks <= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' Parameter](https://agentprime.io/advisories/CVE-2026-5062.md) `CVE-2026-5062` · CVE record: supercleanse PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links · CVSS 4.9 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection - [Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection](https://agentprime.io/advisories/CVE-2026-15941.md) `CVE-2026-15941` · CVE record: Relevanssi Relevanssi Premium – A Better Search and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection - [ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter](https://agentprime.io/advisories/CVE-2026-11421.md) `CVE-2026-11421` · CVE record: wedevs ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection - [VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection](https://agentprime.io/advisories/CVE-2026-15918.md) `CVE-2026-15918` · CVE record: e4jvikwp VikAppointments Services Booking Calendar · CVSS 7.5 High · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection - [lavkush-maurya Student-Registration-System changepass.php sql injection](https://agentprime.io/advisories/CVE-2026-18896.md) `CVE-2026-18896` · CVE record: lavkush-maurya Student-Registration-System · CVSS 5.3 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection, SQL injection - [ESAFENET CDG usbkey;logindojojs sql injection](https://agentprime.io/advisories/CVE-2026-18859.md) `CVE-2026-18859` · CVE record: ESAFENET CDG · CVSS 6.9 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection, SQL injection - [Shandong Hoteam PDM Product Data Management System DataService GetStoredClassByFilter sql injection](https://agentprime.io/advisories/CVE-2026-18854.md) `CVE-2026-18854` · CVE record: Shandong Hoteam PDM Product Data Management System · CVSS 6.9 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection, SQL injection - [Atals-Livre SQL Injection via Unsanitized GET Parameter in supp()](https://agentprime.io/advisories/CVE-2026-69704.md) `CVE-2026-69704` · CVE record: maximeAmini Atals-Livre · CVSS 7.0 High · Not analysed yet · Published 4 Aug 2026 · Tags: SQL injection - [SQL injection in Veeam ONE](https://agentprime.io/advisories/CVE-2026-64631.md) `CVE-2026-64631` · CVE record: Veeam ONE · CVSS 8.6 High · Not analysed yet · Published 4 Aug 2026 · Tags: SQL injection - [chetans9 core-php-admin-panel customers.php sql injection](https://agentprime.io/advisories/CVE-2026-18766.md) `CVE-2026-18766` · CVE record: chetans9 core-php-admin-panel · CVSS 5.3 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Other injection, SQL injection - [Koha - SQL Injection in reports/issues_stats.pl](https://agentprime.io/advisories/CVE-2026-70373.md) `CVE-2026-70373` · CVE record: Koha Community Koha · CVSS 8.8 High · Not analysed yet · Published 4 Aug 2026 · Tags: SQL injection - [Koha - SQL Injection in reports/bor_issues_top.pl](https://agentprime.io/advisories/CVE-2026-70372.md) `CVE-2026-70372` · CVE record: Koha Community Koha · CVSS 8.8 High · Not analysed yet · Published 4 Aug 2026 · Tags: SQL injection - [Koha - SQL Injection in reports/issues_avg_stats.pl](https://agentprime.io/advisories/CVE-2026-70371.md) `CVE-2026-70371` · CVE record: Koha Community Koha · CVSS 8.8 High · Not analysed yet · Published 4 Aug 2026 · Tags: SQL injection - [Koha - SQL Injection in reports/catalogue_stats.pl](https://agentprime.io/advisories/CVE-2026-70370.md) `CVE-2026-70370` · CVE record: Koha Community Koha · CVSS 8.8 High · Not analysed yet · Published 4 Aug 2026 · Tags: SQL injection - [Koha - SQL Injection in reports/acquisitions_stats.pl](https://agentprime.io/advisories/CVE-2026-70369.md) `CVE-2026-70369` · CVE record: Koha Community Koha · CVSS 8.8 High · Not analysed yet · Published 4 Aug 2026 · Tags: SQL injection - [Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter](https://agentprime.io/advisories/CVE-2026-14872.md) `CVE-2026-14872` · CVE record: Unknown Database for Contact Form 7, WPforms, Elementor forms · CVSS 6.8 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: SQL injection - [cemtan sar2html Search sar2html.py sql injection](https://agentprime.io/advisories/CVE-2026-18719.md) `CVE-2026-18719` · CVE record: cemtan sar2html · CVSS 5.3 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Other injection, SQL injection - [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-48330.md) `CVE-2026-48330` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Aug 2026 · Tags: SQL injection - [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-48326.md) `CVE-2026-48326` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Aug 2026 · Tags: SQL injection - [Shlink Blind SQL Injection via tags/stats orderBy Parameter](https://agentprime.io/advisories/CVE-2026-18737.md) `CVE-2026-18737` · CVE record: shlinkio Shlink · CVSS 7.1 High · Not analysed yet · Published 3 Aug 2026 · Tags: SQL injection - [Sequelize: SQL Injection (Oracle DB)](https://agentprime.io/advisories/GHSA-v8fg-2rw7-q452.md) `GHSA-v8fg-2rw7-q452`, `CVE-2026-69240` · npm `sequelize`: affected `<6.37.4`, fixed in `6.37.4` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Aug 2026 · Tags: SQL injection - [Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter](https://agentprime.io/advisories/CVE-2026-41453.md) `CVE-2026-41453` · CVE record: krayin laravel-crm · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: SQL injection - [Duplicate Advisory: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB](https://agentprime.io/advisories/GHSA-pqpf-6vqv-6w92.md) `GHSA-pqpf-6vqv-6w92` · Go `github.com/siyuan-note/siyuan`: affected `*`, no fixed version yet · CVSS 10.0 Critical · Withdrawn · Not analysed yet · Published 3 Aug 2026 · Tags: SQL injection - [Duplicate Advisory: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write](https://agentprime.io/advisories/GHSA-p2x7-4c4p-8wh6.md) `GHSA-p2x7-4c4p-8wh6` · Go `github.com/siyuan-note/siyuan/kernel`: affected `*`, no fixed version yet · CVSS 10.0 Critical · Withdrawn · Not analysed yet · Published 3 Aug 2026 · Tags: SQL injection - [Duplicate Advisory: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking](https://agentprime.io/advisories/GHSA-5w4j-hchp-r332.md) `GHSA-5w4j-hchp-r332` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<=3.7.2`, no fixed version yet · CVSS 10.0 Critical · Withdrawn · Not analysed yet · Published 3 Aug 2026 · Tags: SQL injection - [osCommerce Email Template Configuration EmailController.php EmailController sql injection](https://agentprime.io/advisories/CVE-2026-18592.md) `CVE-2026-18592` · CVE record: osCommerce · CVSS 5.1 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Other injection, SQL injection - [LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie](https://agentprime.io/advisories/CVE-2026-16572.md) `CVE-2026-16572` · CVE record: Unknown LogMyTrip · CVSS 8.6 High · Not analysed yet · Published 3 Aug 2026 · Tags: SQL injection - [SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplication](https://agentprime.io/advisories/CVE-2026-16539.md) `CVE-2026-16539` · CVE record: Unknown sm page duplicator · CVSS 8.1 High · Not analysed yet · Published 3 Aug 2026 · Tags: SQL injection - [Super Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_tracking](https://agentprime.io/advisories/CVE-2026-12965.md) `CVE-2026-12965` · CVE record: Unknown Super Store Finder WordPress · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Aug 2026 · Tags: SQL injection - [Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form](https://agentprime.io/advisories/CVE-2026-16532.md) `CVE-2026-16532` · CVE record: Unknown Link Library · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Aug 2026 · Tags: SQL injection - [A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in the CommentBat feature.](https://agentprime.io/advisories/CVE-2026-52521.md) `CVE-2026-52521` · CVE record · CVSS 8.1 High · Not analysed yet · Published 3 Aug 2026 · Tags: SQL injection - [SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller/Backend.php component](https://agentprime.io/advisories/CVE-2026-51775.md) `CVE-2026-51775` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Aug 2026 · Tags: SQL injection - [PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS](https://agentprime.io/advisories/CVE-2026-65321.md) `CVE-2026-65321` · CVE record: laughingman7743 PyAthena · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Aug 2026 · Tags: SQL injection - [AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription\[\] Parameter](https://agentprime.io/advisories/CVE-2026-14920.md) `CVE-2026-14920` · CVE record: Unknown AcyMailing · CVSS 8.2 High · Not analysed yet · Published 2 Aug 2026 · Tags: SQL injection - [CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter](https://agentprime.io/advisories/CVE-2026-6453.md) `CVE-2026-6453` · CVE record: cubewp1211 CubeWP Framework · CVSS 6.5 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: SQL injection - [WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter](https://agentprime.io/advisories/CVE-2026-17555.md) `CVE-2026-17555` · CVE record: wpvividplugins WPvivid — Backup, Migration & Staging · CVSS 4.9 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: SQL injection - [Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter](https://agentprime.io/advisories/CVE-2026-15951.md) `CVE-2026-15951` · CVE record: icegram Icegram Mailer – Reliable Email Deliverability, No-code SMTP Replacement & Email logs · CVSS 4.9 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: SQL injection - [Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter](https://agentprime.io/advisories/CVE-2026-15018.md) `CVE-2026-15018` · CVE record: davejesch Database Collation Fix · CVSS 5.3 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: SQL injection - [GSheetConnector <= 5.2.1 - Authenticated (Administrator+) SQL Injection via 's' Parameter](https://agentprime.io/advisories/CVE-2026-16614.md) `CVE-2026-16614` · CVE record: westerndeal GSheetConnector – CF7 Google Sheets Connector · CVSS 4.9 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: SQL injection - [Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages\[\]\[id\]' Parameter](https://agentprime.io/advisories/CVE-2026-16087.md) `CVE-2026-16087` · CVE record: icegram Icegram Engage – Popups, Optins, CTAs & Lead Generation · CVSS 6.5 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: SQL injection - [Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search](https://agentprime.io/advisories/CVE-2026-13596.md) `CVE-2026-13596` · CVE record: Unknown Participants Database · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Aug 2026 · Tags: SQL injection - [Pinpoint Booking System <= 2.9.9.6.9 - Authenticated (Administrator+) SQL Injection via 'field' Parameter](https://agentprime.io/advisories/CVE-2026-15403.md) `CVE-2026-15403` · CVE record: dotonpaper Pinpoint Booking System – Version 2 · CVSS 4.9 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: SQL injection - [NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE](https://agentprime.io/advisories/GHSA-p849-8hwh-84j9.md) `GHSA-p849-8hwh-84j9`, `CVE-2026-52887` · npm `@nocobase/plugin-notification-in-app-message`: affected `<2.0.61`, fixed in `2.0.61` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Jul 2026 · Tags: SQL injection - [SQL injection in WebPros cPanel and others](https://agentprime.io/advisories/CVE-2026-58048.md) `CVE-2026-58048` · CVE record: WebPros cPanel and 1 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Jul 2026 · Tags: SQL injection - [pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)](https://agentprime.io/advisories/CVE-2026-17351.md) `CVE-2026-17351` · CVE record: pgadmin.org pgAdmin 4 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Jul 2026 · Tags: SQL injection, CWE-115 - [pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)](https://agentprime.io/advisories/CVE-2026-17346.md) `CVE-2026-17346` · CVE record: pgadmin.org pgAdmin 4 · CVSS 8.7 High · Not analysed yet · Published 31 Jul 2026 · Tags: SQL injection - [@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL](https://agentprime.io/advisories/GHSA-pqh8-p93p-2rx7.md) `GHSA-pqh8-p93p-2rx7`, `CVE-2026-123810` · npm `@dynatrace-oss/dynatrace-mcp-server`: affected `<2.1.1`, fixed in `2.1.1` · CVSS 4.3 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: SQL injection, Other injection - [Authenticated SQL Injection in PHP Poll Script](https://agentprime.io/advisories/CVE-2026-46593.md) `CVE-2026-46593` · CVE record: PHP Jabbers PHP Poll Script · CVSS 8.6 High · Not analysed yet · Published 31 Jul 2026 · Tags: SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .