# SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Unauthenticated SQL Injection](https://agentprime.io/advisories/CVE-2025-13294.md)
  `CVE-2025-13294` · CVE record: TBEA TBEA TLogger (TBEA Communication Box 3rd Generation) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: SQL injection
- [Metabase SQL injection via public card or dashboard](https://agentprime.io/advisories/CVE-2026-72899.md)
  `CVE-2026-72899` · CVE record: Metabase Metabase · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: SQL injection
- [Metabase SQL injection via password reset endpoint](https://agentprime.io/advisories/CVE-2026-72898.md)
  `CVE-2026-72898` · CVE record: Metabase Metabase · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.98 · Not analysed yet · Published 10 Aug 2026 · Tags: SQL injection
- [Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer](https://agentprime.io/advisories/CVE-2026-72731.md)
  `CVE-2026-72731` · CVE record: discourse discourse · CVSS 7.1 High · Not analysed yet · Published 10 Aug 2026 · Tags: SQL injection
- [ReadyEcommerce < 4.5.2 Unauthenticated SQL Injection via ProductController.php](https://agentprime.io/advisories/CVE-2026-63106.md)
  `CVE-2026-63106` · CVE record: Razinsoft Ready eCommerce · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: SQL injection
- [Tencent APIJSON - Unauthenticated SQL Injection via @having Operator Map-Form Bypass](https://agentprime.io/advisories/CVE-2026-72565.md)
  `CVE-2026-72565` · CVE record: Tencent APIJSON · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: SQL injection
- [Apache Ranger: SQL Injection vulnerability in lookup functionality](https://agentprime.io/advisories/CVE-2026-32227.md)
  `CVE-2026-32227` · CVE record: Apache Software Foundation Apache Ranger · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: SQL injection
- [Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report](https://agentprime.io/advisories/CVE-2026-14238.md)
  `CVE-2026-14238` · CVE record: Unknown vitepos · CVSS 4.1 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: SQL injection
- [ProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter](https://agentprime.io/advisories/CVE-2026-19053.md)
  `CVE-2026-19053` · CVE record: Unknown ProSolution WP Client · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: SQL injection
- [ProSolution WP Client < 2.0.9 - Unauthenticated SQLi and Plugin Data Deletion via 'removesite' Cookie](https://agentprime.io/advisories/CVE-2026-19049.md)
  `CVE-2026-19049` · CVE record: Unknown ProSolution WP Client · CVSS 8.6 High · Not analysed yet · Published 10 Aug 2026 · Tags: SQL injection
- [Term Pages < 2.0.0 - Unauthenticated SQL Injection via tp_lookup](https://agentprime.io/advisories/CVE-2026-16949.md)
  `CVE-2026-16949` · CVE record: Unknown Term Pages · CVSS 5.8 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: SQL injection
- [Library Management System < 3.6.7 - Subscriber+ SQL Injection via Filter Value](https://agentprime.io/advisories/CVE-2026-18666.md)
  `CVE-2026-18666` · CVE record: Unknown Library Management System · CVSS 4.3 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: SQL injection
- [SourceCodester Simple Doctors Appointment System ajax.php set_appointment sql injection](https://agentprime.io/advisories/CVE-2026-19384.md)
  `CVE-2026-19384` · CVE record: SourceCodester Simple Doctors Appointment System · CVSS 6.9 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System viewdoctorconsultancycharge.php sql injection](https://agentprime.io/advisories/CVE-2026-19364.md)
  `CVE-2026-19364` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Other injection, SQL injection
- [MingSoft MCMS ms-mdiy list.do ModelDataImpl.queryDiyFormData sql injection](https://agentprime.io/advisories/CVE-2026-19355.md)
  `CVE-2026-19355` · CVE record: MingSoft MCMS · CVSS 6.9 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Other injection, SQL injection
- [lock-upme OPMS IN Clause message.go sql injection](https://agentprime.io/advisories/CVE-2026-19354.md)
  `CVE-2026-19354` · CVE record: lock-upme OPMS · CVSS 5.3 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Other injection, SQL injection
- [dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection](https://agentprime.io/advisories/CVE-2026-19351.md)
  `CVE-2026-19351` · CVE record: dresende node-sql-query · CVSS 6.9 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System viewdoctor.php sql injection](https://agentprime.io/advisories/CVE-2026-19347.md)
  `CVE-2026-19347` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Other injection, SQL injection
- [code-projects Task Management System comment_count_user.php sql injection](https://agentprime.io/advisories/CVE-2026-19344.md)
  `CVE-2026-19344` · CVE record: code-projects Task Management System · CVSS 6.9 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Other injection, SQL injection
- [code-projects Task Management System AdminLogin.php sql injection](https://agentprime.io/advisories/CVE-2026-19343.md)
  `CVE-2026-19343` · CVE record: code-projects Task Management System · CVSS 6.9 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Other injection, SQL injection
- [CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation](https://agentprime.io/advisories/CVE-2026-17017.md)
  `CVE-2026-17017` · CVE record: Unknown CubeWP Framework · CVSS 8.1 High · Not analysed yet · Published 9 Aug 2026 · Tags: SQL injection
- [WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter](https://agentprime.io/advisories/CVE-2026-18473.md)
  `CVE-2026-18473` · CVE record: Unknown WP Directory Kit · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Aug 2026 · Tags: SQL injection
- [WordPress File Upload < 5.1.8 - Unauthenticated SQL Injection via uniqueuploadid](https://agentprime.io/advisories/CVE-2026-17044.md)
  `CVE-2026-17044` · CVE record: Unknown Iptanus File Upload · CVSS 8.6 High · Not analysed yet · Published 9 Aug 2026 · Tags: SQL injection
- [WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter](https://agentprime.io/advisories/CVE-2026-16589.md)
  `CVE-2026-16589` · CVE record: Unknown WP Directory Kit · CVSS 7.7 High · Not analysed yet · Published 8 Aug 2026 · Tags: SQL injection
- [SourceCodester Simple Doctors Appointment System ajax.php delete_appointment sql injection](https://agentprime.io/advisories/CVE-2026-19231.md)
  `CVE-2026-19231` · CVE record: SourceCodester Simple Doctors Appointment System · CVSS 6.9 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Other injection, SQL injection
- [CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions](https://agentprime.io/advisories/GHSA-c9w5-rwh3-7pm9.md)
  `GHSA-c9w5-rwh3-7pm9`, `CVE-2026-63221`, `PKSA-t8h5-ngj8-z43w` · Packagist `codeigniter4/framework`: affected `>=4.3.0, <4.7.4`, fixed in `4.7.4` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Aug 2026 · Tags: SQL injection
- [Frappe has potential SQL Injection due to missing validation](https://agentprime.io/advisories/CVE-2025-58375.md)
  `CVE-2025-58375` · CVE record: frappe frappe · CVSS 8.1 High · Not analysed yet · Published 7 Aug 2026 · Tags: SQL injection
- [SQL injection in WebPros Plesk](https://agentprime.io/advisories/CVE-2026-64636.md)
  `CVE-2026-64636` · CVE record: WebPros Plesk · CVSS 7.7 High · Not analysed yet · Published 7 Aug 2026 · Tags: SQL injection
- [SourceCodester Photo Share Website ajax.php signup sql injection](https://agentprime.io/advisories/CVE-2026-19211.md)
  `CVE-2026-19211` · CVE record: SourceCodester Photo Share Website · CVSS 6.9 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Other injection, SQL injection
- [SQL injection via the :comment option in Postgrex.stream/4](https://agentprime.io/advisories/GHSA-3gww-3f36-2388.md)
  `GHSA-3gww-3f36-2388`, `CVE-2026-66838`, `EEF-CVE-2026-66838` · Hex `postgrex`: affected `>=0.19.3, <0.22.4`, fixed in `0.22.4` · CVSS 5.9 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: SQL injection
- [Content Views < 4.5 - Subscriber+ SQL Injection via preview_request](https://agentprime.io/advisories/CVE-2026-15361.md)
  `CVE-2026-15361` · CVE record: Unknown Content Views · CVSS 8.1 High · Not analysed yet · Published 7 Aug 2026 · Tags: SQL injection
- [SourceCodester Photo Share Website ajax.php login sql injection](https://agentprime.io/advisories/CVE-2026-19196.md)
  `CVE-2026-19196` · CVE record: SourceCodester Photo Share Website · CVSS 6.9 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System viewappointment.php sql injection](https://agentprime.io/advisories/CVE-2026-19071.md)
  `CVE-2026-19071` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System viewadmin.php sql injection](https://agentprime.io/advisories/CVE-2026-19070.md)
  `CVE-2026-19070` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System treatmentrecord.php sql injection](https://agentprime.io/advisories/CVE-2026-19069.md)
  `CVE-2026-19069` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System treatmentdetail.php sql injection](https://agentprime.io/advisories/CVE-2026-19068.md)
  `CVE-2026-19068` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System treatment.php sql injection](https://agentprime.io/advisories/CVE-2026-19067.md)
  `CVE-2026-19067` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, SQL injection
- [chiuwingyan house selectall.action sql injection](https://agentprime.io/advisories/CVE-2026-19062.md)
  `CVE-2026-19062` · CVE record: chiuwingyan house · CVSS 6.9 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, SQL injection
- [Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi](https://agentprime.io/advisories/CVE-2026-3430.md)
  `CVE-2026-3430` · CVE record: Unknown Creative Mail · CVSS 8.6 High · Not analysed yet · Published 6 Aug 2026 · Tags: SQL injection
- [Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle](https://agentprime.io/advisories/CVE-2026-34191.md)
  `CVE-2026-34191` · CVE record: Apache Software Foundation Apache Portable Runtime Utility · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: SQL injection
- [WordPress WordPress File Upload plugin <= 5.1.7 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66447.md)
  `CVE-2026-66447` · CVE record: nickboss WordPress File Upload · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: SQL injection
- [WordPress WP Job Portal plugin <= 2.5.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65569.md)
  `CVE-2026-65569` · CVE record: wpjobportal WP Job Portal · CVSS 8.5 High · Not analysed yet · Published 6 Aug 2026 · Tags: SQL injection
- [WordPress Qode Tours plugin <= 3.1.3.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65546.md)
  `CVE-2026-65546` · CVE record: QODE Qode Tours · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: SQL injection
- [WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65520.md)
  `CVE-2026-65520` · CVE record: miniOrange WP OAuth Server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: SQL injection
- [WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65508.md)
  `CVE-2026-65508` · CVE record: NSquared Simply Schedule Appointments · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: SQL injection
- [SQLi in Loca Software's CMS](https://agentprime.io/advisories/CVE-2026-5134.md)
  `CVE-2026-5134` · CVE record: Loca Software Informatics Technology Ltd. Co. CMS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: SQL injection
- [SourceCodester Computer Repair Shop Management System Master.php delete_product sql injection](https://agentprime.io/advisories/CVE-2026-19021.md)
  `CVE-2026-19021` · CVE record: SourceCodester Computer Repair Shop Management System · CVSS 6.9 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, SQL injection
- [itsourcecode Hospital Management System servicetype.php sql injection](https://agentprime.io/advisories/CVE-2026-19020.md)
  `CVE-2026-19020` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, SQL injection
- [WPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_number](https://agentprime.io/advisories/CVE-2026-12713.md)
  `CVE-2026-12713` · CVE record: Unknown WPCargo Track & Trace · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: SQL injection
- [Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import](https://agentprime.io/advisories/CVE-2026-16065.md)
  `CVE-2026-16065` · CVE record: Unknown Welcart e-Commerce · CVSS 6.5 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: SQL injection
- [SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the \`field\` and \`order\` parameters in paginated list endpoints](https://agentprime.io/advisories/CVE-2026-67689.md)
  `CVE-2026-67689` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: SQL injection
- [Rongzhitong Visual Integrated Command and Dispatch Platform findAll sql injection](https://agentprime.io/advisories/CVE-2026-18970.md)
  `CVE-2026-18970` · CVE record: Rongzhitong Visual Integrated Command and Dispatch Platform · CVSS 6.9 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection, SQL injection
- [imranrisal-dev Student-Management-System Login loginCheckTest.php sql injection](https://agentprime.io/advisories/CVE-2026-18958.md)
  `CVE-2026-18958` · CVE record: imranrisal-dev Student-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection, SQL injection
- [Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation](https://agentprime.io/advisories/CVE-2026-10716.md)
  `CVE-2026-10716` · CVE record: Directus Directus · CVSS 7.5 High · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection
- [Subrion CMS Admin Grid SQL Injection via Unwhitelisted ORDER BY sort Parameter](https://agentprime.io/advisories/CVE-2026-71292.md)
  `CVE-2026-71292` · CVE record: intelliants subrion · CVSS 7.2 High · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection
- [Koha SQL Injection via order_by and {order}\_ovalue Parameters in guided_reports.pl](https://agentprime.io/advisories/CVE-2026-71288.md)
  `CVE-2026-71288` · CVE record: Koha Community Koha · CVSS 8.8 High · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection
- [Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL Injection](https://agentprime.io/advisories/CVE-2026-71287.md)
  `CVE-2026-71287` · CVE record: Cacti cacti · CVSS 8.8 High · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection
- [ChirpStack SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter](https://agentprime.io/advisories/CVE-2026-71282.md)
  `CVE-2026-71282` · CVE record: chirpstack chirpstack · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection
- [Magistrala (formerly Mainflux) IoT Platform SQL Injection via format Query Parameter](https://agentprime.io/advisories/CVE-2026-71276.md)
  `CVE-2026-71276` · CVE record: absmach magistrala · CVSS 7.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection
- [Inventory-Management-System-PHP - Unauthenticated SQL Injection in Login and Product Deletion](https://agentprime.io/advisories/CVE-2026-71248.md)
  `CVE-2026-71248` · CVE record: Harsh21Patel Inventory-Management-System-PHP · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection

Newest: <https://agentprime.io/advisories/tag/sql-injection.md>
Older: <https://agentprime.io/advisories/tag/sql-injection.md?cursor=WyIyMDI2LTA4LTA1VDEwOjU3OjAyLjg2MDAwMFoiLCJDVkUtMjAyNi03MTI0OCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=sql-injection&cursor=WyIyMDI2LTA4LTEwVDIwOjUxOjIzLjY5NjAwMFoiLCJDVkUtMjAyNi03MjkwOCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/sql-injection/?cursor=WyIyMDI2LTA4LTEwVDIwOjUxOjIzLjY5NjAwMFoiLCJDVkUtMjAyNi03MjkwOCJd>. Everything for agents: <https://agentprime.io/llms.txt>.