# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [SourceCodester Pet Grooming Management Software get_barcode_data.php sql injection](https://agentprime.io/advisories/CVE-2026-75014.md) `CVE-2026-75014` · CVE record: SourceCodester Pet Grooming Management Software · CVSS 6.9 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Other injection, SQL injection - [Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5](https://agentprime.io/advisories/CVE-2026-74254.md) `CVE-2026-74254` · CVE record: joomlack.fr Page Builder CK extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Aug 2026 · Tags: SQL injection - [itsourcecode Hospital Management System viewprescriptionrecord.php sql injection](https://agentprime.io/advisories/CVE-2026-20000.md) `CVE-2026-20000` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Other injection, SQL injection - [Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service](https://agentprime.io/advisories/CVE-2026-15623.md) `CVE-2026-15623` · CVE record: Google Cloud Google SecOps (Chronicle SOAR) · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Aug 2026 · Tags: SQL injection - [itsourcecode Hospital Management System viewpaymentreport.php sql injection](https://agentprime.io/advisories/CVE-2026-19973.md) `CVE-2026-19973` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Hospital Management System viewpatient.php sql injection](https://agentprime.io/advisories/CVE-2026-19972.md) `CVE-2026-19972` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Other injection, SQL injection - [zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality.](https://agentprime.io/advisories/CVE-2026-67917.md) `CVE-2026-67917` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Aug 2026 · Tags: SQL injection - [SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code](https://agentprime.io/advisories/CVE-2026-67854.md) `CVE-2026-67854` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Aug 2026 · Tags: SQL injection - [SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store() functions.](https://agentprime.io/advisories/CVE-2026-51346.md) `CVE-2026-51346` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Aug 2026 · Tags: SQL injection - [The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection (time-based) vulnerability.](https://agentprime.io/advisories/CVE-2026-50769.md) `CVE-2026-50769` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Aug 2026 · Tags: SQL injection - [Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6](https://agentprime.io/advisories/CVE-2026-74251.md) `CVE-2026-74251` · CVE record: phoca.cz Phoca Cart extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Aug 2026 · Tags: SQL injection - [Gallery by BestWebSoft <= 4.7.9 - Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys](https://agentprime.io/advisories/CVE-2026-2497.md) `CVE-2026-2497` · CVE record: bestwebsoft Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress · CVSS 7.2 High · Not analysed yet · Published 16 Aug 2026 · Tags: SQL injection - [WP Directory Kit < 1.5.7 - Admin+ SQL Injection via section Parameter](https://agentprime.io/advisories/CVE-2026-18653.md) `CVE-2026-18653` · CVE record: Unknown WP Directory Kit · CVSS 7.2 High · Not analysed yet · Published 16 Aug 2026 · Tags: SQL injection - [WC Vendors <= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter](https://agentprime.io/advisories/CVE-2026-15351.md) `CVE-2026-15351` · CVE record: wcvendors WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors · CVSS 4.9 Medium · Not analysed yet · Published 16 Aug 2026 · Tags: SQL injection - [The School Management <= 5.4 - Authenticated (Custom+) SQL Injection via 'order\[0\]\[dir\]' Parameter](https://agentprime.io/advisories/CVE-2026-9767.md) `CVE-2026-9767` · CVE record: weblizar The School Management – Education & Learning ERP · CVSS 6.5 Medium · Not analysed yet · Published 16 Aug 2026 · Tags: SQL injection - [Slider Hero with Video Background, Animation <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate)](https://agentprime.io/advisories/CVE-2026-17582.md) `CVE-2026-17582` · CVE record: quantumcloud Slider Hero with Video Background, Animation · CVSS 4.9 Medium · Not analysed yet · Published 16 Aug 2026 · Tags: SQL injection - [User Login History <= 2.1.7 - Authenticated (Administrator+) SQL Injection via 'blog_id' Parameter](https://agentprime.io/advisories/CVE-2026-2283.md) `CVE-2026-2283` · CVE record: faiyazalam User Login History · CVSS 4.9 Medium · Not analysed yet · Published 16 Aug 2026 · Tags: SQL injection - [itsourcecode Hospital Management System vieworder.php sql injection](https://agentprime.io/advisories/CVE-2026-19934.md) `CVE-2026-19934` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 16 Aug 2026 · Tags: Other injection, SQL injection - [Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) SQL Injection via 'randon_category' Quiz Option](https://agentprime.io/advisories/CVE-2026-15963.md) `CVE-2026-15963` · CVE record: expresstech Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker · CVSS 6.5 Medium · Not analysed yet · Published 16 Aug 2026 · Tags: SQL injection - [Fullscreen Galleria <= 1.6.12 - Authenticated (Contributor+) SQL Injection via 'href' Attribute in Post Content](https://agentprime.io/advisories/CVE-2026-16079.md) `CVE-2026-16079` · CVE record: pdamsten Fullscreen Galleria · CVSS 6.5 Medium · Not analysed yet · Published 16 Aug 2026 · Tags: SQL injection - [NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter](https://agentprime.io/advisories/CVE-2026-15602.md) `CVE-2026-15602` · CVE record: webaways NEX-Forms – Ultimate Forms Plugin for WordPress · CVSS 4.9 Medium · Not analysed yet · Published 16 Aug 2026 · Tags: SQL injection - [Evergreen open-ils.fielder OpenSRF Service osrf-gateway-v1 sql injection](https://agentprime.io/advisories/CVE-2026-19926.md) `CVE-2026-19926` · CVE record: Evergreen · CVSS 6.9 Medium · Not analysed yet · Published 16 Aug 2026 · Tags: Other injection, SQL injection - [SourceCodester Stock Management System Master.php delete_supplier sql injection](https://agentprime.io/advisories/CVE-2026-19925.md) `CVE-2026-19925` · CVE record: SourceCodester Stock Management System · CVSS 5.1 Medium · Not analysed yet · Published 16 Aug 2026 · Tags: Other injection, SQL injection - [code-projects Online Shopping System checkout_process.php sql injection](https://agentprime.io/advisories/CVE-2026-19923.md) `CVE-2026-19923` · CVE record: code-projects Online Shopping System · CVSS 5.3 Medium · Not analysed yet · Published 16 Aug 2026 · Tags: Other injection, SQL injection - [code-projects Online Shopping System homeaction.php sql injection](https://agentprime.io/advisories/CVE-2026-19921.md) `CVE-2026-19921` · CVE record: code-projects Online Shopping System · CVSS 5.3 Medium · Not analysed yet · Published 16 Aug 2026 · Tags: Other injection, SQL injection - [code-projects Online Shopping System action.php sql injection](https://agentprime.io/advisories/CVE-2026-19920.md) `CVE-2026-19920` · CVE record: code-projects Online Shopping System · CVSS 5.3 Medium · Not analysed yet · Published 15 Aug 2026 · Tags: Other injection, SQL injection - [code-projects Online Shopping System Login login.php sql injection](https://agentprime.io/advisories/CVE-2026-19919.md) `CVE-2026-19919` · CVE record: code-projects Online Shopping System · CVSS 6.9 Medium · Not analysed yet · Published 15 Aug 2026 · Tags: Other injection, SQL injection - [code-projects Online Food Order System delete_food_items1.php sql injection](https://agentprime.io/advisories/CVE-2026-19917.md) `CVE-2026-19917` · CVE record: code-projects Online Food Order System · CVSS 5.3 Medium · Not analysed yet · Published 15 Aug 2026 · Tags: Other injection, SQL injection - [Jinher OA attendance_out_approve.aspx sql injection](https://agentprime.io/advisories/CVE-2026-19905.md) `CVE-2026-19905` · CVE record: Jinher OA · CVSS 6.9 Medium · Not analysed yet · Published 15 Aug 2026 · Tags: Other injection, SQL injection - [SourceCodester Class and Exam Timetabling System edit_teacher.php sql injection](https://agentprime.io/advisories/CVE-2026-19899.md) `CVE-2026-19899` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 15 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Hospital Management System viewmedicine.php sql injection](https://agentprime.io/advisories/CVE-2026-19894.md) `CVE-2026-19894` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 15 Aug 2026 · Tags: Other injection, SQL injection - [WPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter](https://agentprime.io/advisories/CVE-2026-12248.md) `CVE-2026-12248` · CVE record: WPML WPML Multilingual CMS · CVSS 6.5 Medium · Not analysed yet · Published 15 Aug 2026 · Tags: SQL injection - [Authenticated SQL Injection in AppFlowy](https://agentprime.io/advisories/CVE-2026-16007.md) `CVE-2026-16007` · CVE record: AppFlowy-IO AppFlowy-Cloud · CVSS 7.1 High · Not analysed yet · Published 15 Aug 2026 · Tags: SQL injection - [Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via Pattern JSON Keys/Values](https://agentprime.io/advisories/CVE-2026-16146.md) `CVE-2026-16146` · CVE record: matthiasnordwig Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms · CVSS 4.9 Medium · Not analysed yet · Published 15 Aug 2026 · Tags: SQL injection - [KiviCare <= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter](https://agentprime.io/advisories/CVE-2026-15453.md) `CVE-2026-15453` · CVE record: iqonicdesign KiviCare – Clinic & Patient Management System (EHR) · CVSS 6.5 Medium · Not analysed yet · Published 15 Aug 2026 · Tags: SQL injection - [Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parameter](https://agentprime.io/advisories/CVE-2026-16094.md) `CVE-2026-16094` · CVE record: matthiasnordwig Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms · CVSS 4.9 Medium · Not analysed yet · Published 15 Aug 2026 · Tags: SQL injection - [Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId'](https://agentprime.io/advisories/CVE-2026-16586.md) `CVE-2026-16586` · CVE record: contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe · CVSS 6.5 Medium · Not analysed yet · Published 15 Aug 2026 · Tags: SQL injection - [Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause](https://agentprime.io/advisories/CVE-2026-15993.md) `CVE-2026-15993` · CVE record: 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder · CVSS 5.3 Medium · Not analysed yet · Published 15 Aug 2026 · Tags: SQL injection - [Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter](https://agentprime.io/advisories/CVE-2026-18387.md) `CVE-2026-18387` · CVE record: trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation · CVSS 6.5 Medium · Not analysed yet · Published 15 Aug 2026 · Tags: SQL injection - [Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection](https://agentprime.io/advisories/CVE-2026-15162.md) `CVE-2026-15162` · CVE record: minnpost Object Sync for Salesforce · CVSS 7.5 High · Not analysed yet · Published 15 Aug 2026 · Tags: SQL injection - [Image Uploader for Welcart <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter](https://agentprime.io/advisories/CVE-2026-16080.md) `CVE-2026-16080` · CVE record: fishpie Image Uploader for Welcart · CVSS 6.5 Medium · Not analysed yet · Published 15 Aug 2026 · Tags: SQL injection - [Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11](https://agentprime.io/advisories/CVE-2026-71571.md) `CVE-2026-71571` · CVE record: icagenda.com iCagenda extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 14 Aug 2026 · Tags: SQL injection - [Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11](https://agentprime.io/advisories/CVE-2026-67365.md) `CVE-2026-67365` · CVE record: icagenda.com iCagenda extension for Joomla · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Aug 2026 · Tags: SQL injection - [IBM Db2 Mirror for i is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-17227.md) `CVE-2026-17227` · CVE record: IBM Db2 Mirror for i · CVSS 5.4 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: SQL injection - [LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB](https://agentprime.io/advisories/CVE-2026-18403.md) `CVE-2026-18403` · CVE record: LimeSurvey LimeSurvey · CVSS 6.0 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: SQL injection - [Metacat has an unauthenticated SQL injection vulnerability](https://agentprime.io/advisories/CVE-2026-48528.md) `CVE-2026-48528` · CVE record: NCEAS metacat · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Aug 2026 · Tags: SQL injection, Authentication bypass - [Emlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase() Function](https://agentprime.io/advisories/CVE-2026-73850.md) `CVE-2026-73850` · CVE record: emlog emlog · CVSS 8.6 High · Not analysed yet · Published 14 Aug 2026 · Tags: SQL injection - [SQL Injection](https://agentprime.io/advisories/CVE-2026-19680.md) `CVE-2026-19680` · CVE record: Tenable, Inc. Security Center · CVSS 7.1 High · Not analysed yet · Published 14 Aug 2026 · Tags: SQL injection - [SQL Injection](https://agentprime.io/advisories/CVE-2026-19631.md) `CVE-2026-19631` · CVE record: Tenable, Inc. Security Center · CVSS 6.9 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: SQL injection - [SourceCodester Simple Client Management System Master.php save_service sql injection](https://agentprime.io/advisories/CVE-2026-19825.md) `CVE-2026-19825` · CVE record: SourceCodester Simple Client Management System · CVSS 6.9 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Other injection, SQL injection - [Duplicate Advisory: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle](https://agentprime.io/advisories/GHSA-p8cp-78hp-wmq8.md) `GHSA-p8cp-78hp-wmq8` · Go `github.com/siyuan-note/siyuan/kernel`: affected `*`, no fixed version yet · CVSS 10.0 Critical · Withdrawn · Not analysed yet · Published 14 Aug 2026 · Tags: SQL injection - [Paymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup](https://agentprime.io/advisories/CVE-2026-15205.md) `CVE-2026-15205` · CVE record: Unknown Paymob for WooCommerce · CVSS 8.6 High · Not analysed yet · Published 14 Aug 2026 · Tags: SQL injection - [affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter](https://agentprime.io/advisories/CVE-2026-12743.md) `CVE-2026-12743` · CVE record: cservit affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display · CVSS 4.9 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: SQL injection - [Bit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter](https://agentprime.io/advisories/CVE-2026-16810.md) `CVE-2026-16810` · CVE record: bitpressadmin Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder · CVSS 6.5 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: SQL injection - [SourceCodester Air Cargo Management System Master.php save_cargo_type sql injection](https://agentprime.io/advisories/CVE-2026-19787.md) `CVE-2026-19787` · CVE record: SourceCodester Air Cargo Management System · CVSS 5.1 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Other injection, SQL injection - [francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection](https://agentprime.io/advisories/CVE-2026-19785.md) `CVE-2026-19785` · CVE record: francoisjacquet RosarioSIS · CVSS 5.3 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Hospital Management System viewdoctortimings.php sql injection](https://agentprime.io/advisories/CVE-2026-19767.md) `CVE-2026-19767` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Other injection, SQL injection - [Raisecom Communication Command and Dispatch Management Platform getpwd.php sql injection](https://agentprime.io/advisories/CVE-2026-19764.md) `CVE-2026-19764` · CVE record: Raisecom Communication Command and Dispatch Management Platform · CVSS 6.9 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Other injection, SQL injection - [Budibase before 3.40.0 SQL Injection via Oracle connector](https://agentprime.io/advisories/CVE-2026-72853.md) `CVE-2026-72853` · CVE record: Budibase budibase · CVSS 8.8 High · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection - [Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook](https://agentprime.io/advisories/CVE-2026-72851.md) `CVE-2026-72851` · CVE record: budibase server · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .