# SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover](https://agentprime.io/advisories/CVE-2026-73663.md)
  `CVE-2026-73663` · CVE record: FreePBX missedcall · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [IBM i is Affected By SQL Injection Vulnerability in Db2 Mirror \[\]](https://agentprime.io/advisories/CVE-2026-16961.md)
  `CVE-2026-16961` · CVE record: IBM i · CVSS 7.6 High · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [ASP-CMS SQL Injection via commentList.asp id Parameter](https://agentprime.io/advisories/CVE-2019-25765.md)
  `CVE-2019-25765` · CVE record: ASP-CMS Project ASP-CMS · CVSS 8.7 High · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [Hongjing e-HR Unauthenticated SQL Injection via getSdutyTree](https://agentprime.io/advisories/CVE-2024-58374.md)
  `CVE-2024-58374` · CVE record: Hongjing Century e-HR · CVSS 8.7 High · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [Zalktis: SQL injection via partner-controlled fields in imported e-invoices](https://agentprime.io/advisories/CVE-2026-59109.md)
  `CVE-2026-59109` · CVE record: Zalktis Programmas (SIA "Zalktis Programmas") Zalktis · CVSS 8.7 High · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection, CWE-20
- [CMS Admin SQL Injection via db_data.php table_name Parameter](https://agentprime.io/advisories/CVE-2026-73670.md)
  `CVE-2026-73670` · CVE record: Saurus Saurus CMS Community Edition · CVSS 8.6 High · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [SourceCodester Simple Student Information System view_department.php sql injection](https://agentprime.io/advisories/CVE-2026-19710.md)
  `CVE-2026-19710` · CVE record: SourceCodester Simple Student Information System · CVSS 6.9 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Other injection, SQL injection
- [Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name](https://agentprime.io/advisories/GHSA-2mhj-fhvg-v428.md)
  `GHSA-2mhj-fhvg-v428`, `CVE-2026-55072`, `PKSA-fpxc-s2d8-24zv` · Packagist `pimcore/pimcore`: affected `<12.3.9 || >=2026.1.0, <2026.1.5`, fixed in `12.3.9`, `2026.1.5` · CVSS 8.5 High · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection, CWE-20
- [WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-28002.md)
  `CVE-2026-28002` · CVE record: Arraytics Booktics · CVSS 8.5 High · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-73346.md)
  `CVE-2026-73346` · CVE record: Mailchimp MailChimp For WooCommerce · CVSS 7.6 High · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [WordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66658.md)
  `CVE-2026-66658` · CVE record: MVPThemes Reviewer · CVSS 8.5 High · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [WordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66478.md)
  `CVE-2026-66478` · CVE record: andy_moyle Church Admin · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [WordPress Everest Backup plugin <= 2.3.12 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66472.md)
  `CVE-2026-66472` · CVE record: everestthemes Everest Backup · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66458.md)
  `CVE-2026-66458` · CVE record: ThimPress RealPress · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66446.md)
  `CVE-2026-66446` · CVE record: If-So Dynamic Content If-So Dynamic Content Personalization · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [WordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66436.md)
  `CVE-2026-66436` · CVE record: RealMag777 Active Products Tables for WooCommerce · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66430.md)
  `CVE-2026-66430` · CVE record: CODEPRESS Visitor Traffic Real Time Statistics Pro · CVSS 8.5 High · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [WordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-61969.md)
  `CVE-2026-61969` · CVE record: Webilia Inc. Listdom · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [WordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-61966.md)
  `CVE-2026-61966` · CVE record: denishua WPJAM Basic · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [WordPress CubeWP plugin <= 1.1.30 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-28168.md)
  `CVE-2026-28168` · CVE record: Imran Tauqeer CubeWP · CVSS 8.5 High · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [WordPress Do Lasso plugin <= 358 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-28156.md)
  `CVE-2026-28156` · CVE record: Lasso Analytics, Inc. Do Lasso · CVSS 8.5 High · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-28142.md)
  `CVE-2026-28142` · CVE record: Shamalli Web Directory Free · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-28001.md)
  `CVE-2026-28001` · CVE record: WPDirectoryKit WP Directory Kit · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-27538.md)
  `CVE-2026-27538` · CVE record: WPDirectoryKit WP Directory Kit · CVSS 7.5 High · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [PostgreSQL expression deparse allows SQL injection via EXTRACT argument](https://agentprime.io/advisories/CVE-2026-15741.md)
  `CVE-2026-15741` · CVE record: PostgreSQL · CVSS 8.8 High · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [SQL Injection](https://agentprime.io/advisories/CVE-2026-11840.md)
  `CVE-2026-11840` · CVE record: Zohocorp ManageEngine Password Manager Pro and 1 more · CVSS 8.8 High · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [Duplicate Advisory: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel](https://agentprime.io/advisories/GHSA-2jmx-q9jf-wp3w.md)
  `GHSA-2jmx-q9jf-wp3w` · Go `github.com/siyuan-note/siyuan/kernel`: affected `*`, no fixed version yet · CVSS 8.0 High · Withdrawn · Not analysed yet · Published 12 Aug 2026 · Tags: SQL injection
- [Filter expression injection via forged keyset pagination cursor in Ash](https://agentprime.io/advisories/GHSA-3gq3-9xm3-c8v3.md)
  `GHSA-3gq3-9xm3-c8v3`, `CVE-2026-67579`, `EEF-CVE-2026-67579` · Hex `ash`: affected `>=1.17.0, <3.31.3`, fixed in `3.31.3` · CVSS 7.5 High · Not analysed yet · Published 12 Aug 2026 · Tags: SQL injection, Insecure deserialization
- [IBM i is Affected By Multiple Vulnerabilities in SQL](https://agentprime.io/advisories/CVE-2026-17111.md)
  `CVE-2026-17111` · CVE record: IBM i · CVSS 7.6 High · Not analysed yet · Published 12 Aug 2026 · Tags: SQL injection
- [CamaleonCMS cama_contact_form Plugin Stored XSS via before_html Field](https://agentprime.io/advisories/CVE-2026-73332.md)
  `CVE-2026-73332` · CVE record: owen2345 CamaleonCMS · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: SQL injection
- [CamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug Field](https://agentprime.io/advisories/CVE-2026-73331.md)
  `CVE-2026-73331` · CVE record: owen2345 CamaleonCMS · CVSS 7.1 High · Not analysed yet · Published 12 Aug 2026 · Tags: SQL injection
- [IBM i is Affected By Multiple Vulnerabilities in SQL](https://agentprime.io/advisories/CVE-2026-17222.md)
  `CVE-2026-17222` · CVE record: IBM i · CVSS 4.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: SQL injection
- [IBM i is Affected By Multiple Vulnerabilities in SQL](https://agentprime.io/advisories/CVE-2026-17419.md)
  `CVE-2026-17419` · CVE record: IBM i · CVSS 6.5 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: SQL injection
- [IBM i is Affected By Multiple Vulnerabilities in SQL](https://agentprime.io/advisories/CVE-2026-17418.md)
  `CVE-2026-17418` · CVE record: IBM i · CVSS 8.5 High · Not analysed yet · Published 12 Aug 2026 · Tags: SQL injection
- [phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration](https://agentprime.io/advisories/GHSA-6pvm-2vjj-rx4w.md)
  `GHSA-6pvm-2vjj-rx4w`, `CVE-2026-47132`, `PKSA-cz4f-38kk-4ywj` · Packagist `thorsten/phpmyfaq`: affected `<4.2.0-alpha`, fixed in `4.2.0-alpha` · CVSS 5.4 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: SQL injection, Information disclosure, CWE-20
- [Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax](https://agentprime.io/advisories/GHSA-m7jc-g4rc-jmvh.md)
  `GHSA-m7jc-g4rc-jmvh`, `CVE-2026-32593`, `PKSA-rw8y-31yz-4tck` · Packagist `winter/wn-backend-module`: affected `<1.2.13`, fixed in `1.2.13` · CVSS 5.9 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: SQL injection
- [SQL injection](https://agentprime.io/advisories/CVE-2025-41771.md)
  `CVE-2025-41771` · CVE record: Phoenix Contact AXC F 1152 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: SQL injection
- [WordPress Tablesome Table plugin <= 1.2.9 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66659.md)
  `CVE-2026-66659` · CVE record: Essekia Tablesome Table · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: SQL injection
- [WP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category](https://agentprime.io/advisories/CVE-2026-18474.md)
  `CVE-2026-18474` · CVE record: Unknown WP Directory Kit · CVSS 8.6 High · Not analysed yet · Published 12 Aug 2026 · Tags: SQL injection
- [WP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via section Parameter](https://agentprime.io/advisories/CVE-2026-18230.md)
  `CVE-2026-18230` · CVE record: Unknown WP Directory Kit · CVSS 8.1 High · Not analysed yet · Published 12 Aug 2026 · Tags: SQL injection
- [Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection](https://agentprime.io/advisories/CVE-2026-18057.md)
  `CVE-2026-18057` · CVE record: Unknown Events Manager · CVSS 8.1 High · Not analysed yet · Published 12 Aug 2026 · Tags: SQL injection
- [Form Maker by 10Web < 1.15.45 - Subscriber+ SQL Injection via display_name](https://agentprime.io/advisories/CVE-2026-16977.md)
  `CVE-2026-16977` · CVE record: Unknown Form Maker by 10Web · CVSS 8.1 High · Not analysed yet · Published 12 Aug 2026 · Tags: SQL injection
- [KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint](https://agentprime.io/advisories/CVE-2026-13613.md)
  `CVE-2026-13613` · CVE record: Unknown KiviCare · CVSS 8.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: SQL injection
- [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-48381.md)
  `CVE-2026-48381` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: SQL injection
- [PeerTube: Unauthenticated remote SQL injection in ActorFollowModel.updateScore()](https://agentprime.io/advisories/CVE-2026-73211.md)
  `CVE-2026-73211` · CVE record: Chocobozzz PeerTube · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: SQL injection
- [Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp](https://agentprime.io/advisories/CVE-2022-50997.md)
  `CVE-2022-50997` · CVE record: Weaver Network Co., Ltd. E-cology 9.0 and 1 more · CVSS 8.7 High · Not analysed yet · Published 11 Aug 2026 · Tags: SQL injection
- [Weaver E-cology 8.0 SQL Injection File Read via SignatureDownLoad](https://agentprime.io/advisories/CVE-2016-20097.md)
  `CVE-2016-20097` · CVE record: Weaver Network Co., Ltd. E-cology 8.0 · CVSS 8.7 High · Not analysed yet · Published 11 Aug 2026 · Tags: SQL injection
- [Microsoft Entra Connect Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-65673.md)
  `CVE-2026-65673` · CVE record: Microsoft Microsoft Entra Connect · CVSS 7.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: SQL injection
- [Twenty: SQL Injection in the \`searchVector\` Field Settings Allows Arbitrary PostgreSQL Execution](https://agentprime.io/advisories/CVE-2026-73069.md)
  `CVE-2026-73069` · CVE record: twentyhq twenty · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: SQL injection
- [Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation](https://agentprime.io/advisories/CVE-2026-72610.md)
  `CVE-2026-72610` · CVE record: Koha Community Koha · CVSS 4.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: SQL injection
- [Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl](https://agentprime.io/advisories/CVE-2026-72609.md)
  `CVE-2026-72609` · CVE record: Koha Community Koha · CVSS 7.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: SQL injection
- [Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name](https://agentprime.io/advisories/CVE-2026-72608.md)
  `CVE-2026-72608` · CVE record: Koha Community Koha · CVSS 6.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: SQL injection
- [Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age](https://agentprime.io/advisories/CVE-2026-72607.md)
  `CVE-2026-72607` · CVE record: Koha Community Koha · CVSS 7.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: SQL injection
- [e107 e107 - SQL Injection](https://agentprime.io/advisories/CVE-2026-72599.md)
  `CVE-2026-72599` · CVE record: e107 e107 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: SQL injection
- [Pimcore pimcore admin-ui-classic-bundle - SQL Injection](https://agentprime.io/advisories/CVE-2026-72562.md)
  `CVE-2026-72562` · CVE record: Pimcore pimcore admin-ui-classic-bundle · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: SQL injection
- [CiviCRM CiviCRM - SQL Injection](https://agentprime.io/advisories/CVE-2026-72558.md)
  `CVE-2026-72558` · CVE record: CiviCRM CiviCRM · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: SQL injection
- [Friendica Friendica - SQL Injection](https://agentprime.io/advisories/CVE-2026-72550.md)
  `CVE-2026-72550` · CVE record: Friendica Friendica · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: SQL injection
- [Win Men Intermational｜Travel Agency Management System - SQL Injection](https://agentprime.io/advisories/CVE-2026-19425.md)
  `CVE-2026-19425` · CVE record: Win Men Intermational Travel Agency Management System · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: SQL injection
- [SQL Injection vulnerability in SAP Social Intelligence](https://agentprime.io/advisories/CVE-2026-66770.md)
  `CVE-2026-66770` · CVE record: SAP_SE SAP Social Intelligence · CVSS 6.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: SQL injection
- [ERPNext: Possibility of SQL injection due to missing validation](https://agentprime.io/advisories/CVE-2026-72908.md)
  `CVE-2026-72908` · CVE record: frappe erpnext · CVSS 6.5 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: SQL injection

Newest: <https://agentprime.io/advisories/tag/sql-injection.md>
Older: <https://agentprime.io/advisories/tag/sql-injection.md?cursor=WyIyMDI2LTA4LTEwVDIwOjUxOjIzLjY5NjAwMFoiLCJDVkUtMjAyNi03MjkwOCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=sql-injection&cursor=WyIyMDI2LTA4LTEzVDIxOjU0OjQzLjMxODAwMFoiLCJDVkUtMjAyNi03Mjg1MSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/sql-injection/?cursor=WyIyMDI2LTA4LTEzVDIxOjU0OjQzLjMxODAwMFoiLCJDVkUtMjAyNi03Mjg1MSJd>. Everything for agents: <https://agentprime.io/llms.txt>.