# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [WordPress WP w3all phpBB plugin <= 3.0.5 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-73998.md) `CVE-2026-73998` · CVE record: axew3 WP w3all phpBB · CVSS 8.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: SQL injection - [WordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-68566.md) `CVE-2026-68566` · CVE record: Repute Infosystems BookingPress Appointment Booking Pro · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: SQL injection - [WordPress Locatoraid Store Locator plugin <= 3.9.72 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66680.md) `CVE-2026-66680` · CVE record: plainware Locatoraid Store Locator · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: SQL injection - [WordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66649.md) `CVE-2026-66649` · CVE record: e-plugins Directory Pro · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: SQL injection - [WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66609.md) `CVE-2026-66609` · CVE record: CodexThemes TheGem (Elementor) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: SQL injection - [WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66594.md) `CVE-2026-66594` · CVE record: lukeseager WordPress Persistent Login · CVSS 8.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: SQL injection - [WordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66593.md) `CVE-2026-66593` · CVE record: CleanTalk Inc Security & Malware scan by CleanTalk · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: SQL injection - [WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66592.md) `CVE-2026-66592` · CVE record: rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: SQL injection - [WordPress Capella theme <= 2.5.5 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2025-15688.md) `CVE-2025-15688` · CVE record: ThemeGoods Capella · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: SQL injection - [n8n before 1.123.69 PostgREST Filter Injection via Supabase](https://agentprime.io/advisories/CVE-2026-77071.md) `CVE-2026-77071` · CVE record: n8n-io n8n · CVSS 7.1 High · Not analysed yet · Published 20 Aug 2026 · Tags: SQL injection - [amirsanni Mini-Inventory-and-Sales-Management-System Transaction.php getAll sql injection](https://agentprime.io/advisories/CVE-2026-76785.md) `CVE-2026-76785` · CVE record: amirsanni Mini-Inventory-and-Sales-Management-System · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection, SQL injection - [DeDeCMS advancedsearch.php sql injection](https://agentprime.io/advisories/CVE-2026-76783.md) `CVE-2026-76783` · CVE record: DeDeCMS · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection, SQL injection - [code-projects Employee Management System Admin Login Endpoint aprocess.php sql injection](https://agentprime.io/advisories/CVE-2026-76764.md) `CVE-2026-76764` · CVE record: code-projects Employee Management System · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection, SQL injection - [code-projects Assessment Management welcome.php sql injection](https://agentprime.io/advisories/CVE-2026-76762.md) `CVE-2026-76762` · CVE record: code-projects Assessment Management · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, SQL injection - [Structured Query Language (SQL) Injection through Custom Function Results in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76364.md) `CVE-2026-76364` · CVE record: Splunk Splunk SOAR · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76343.md) `CVE-2026-76343` · CVE record: Splunk Splunk Enterprise · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76309.md) `CVE-2026-76309` · CVE record: Splunk Splunk Enterprise · CVSS 4.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [code-projects Hospital Information System User Login UsersController.php login sql injection](https://agentprime.io/advisories/CVE-2026-76574.md) `CVE-2026-76574` · CVE record: code-projects Hospital Information System · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, SQL injection - [ISPConfig Authenticated SQL Injection via Remote API primary_id Parameter](https://agentprime.io/advisories/CVE-2026-61518.md) `CVE-2026-61518` · CVE record: ispconfig ispconfig3 · CVSS 8.7 High · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [Wazuh: Local SQL injection in FIM db due to path lookup interpolation in wazuh-syscheckd](https://agentprime.io/advisories/CVE-2026-49392.md) `CVE-2026-49392` · CVE record: wazuh wazuh · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection, CWE-20 - [Cisco Unified Intelligence Center SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-20327.md) `CVE-2026-20327` · CVE record: Cisco Cisco Unified Intelligence Center · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [Cisco Crosswork Security Hardening Release: August 2026](https://agentprime.io/advisories/CVE-2026-20030.md) `CVE-2026-20030` · CVE record: Cisco Cisco Crosswork Planning · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3](https://agentprime.io/advisories/CVE-2026-75954.md) `CVE-2026-75954` · CVE record: cmsjunkie.com J-BusinessDirectory extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [SQL injection in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-71176.md) `CVE-2026-71176` · CVE record: Dell OpenManage Enterprise · CVSS 8.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [phpMyFAQ before 4.1.7 SQL Injection via Glossary](https://agentprime.io/advisories/CVE-2026-76205.md) `CVE-2026-76205` · CVE record: thorsten phpMyFAQ · CVSS 8.6 High · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [SQL injection in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-70422.md) `CVE-2026-70422` · CVE record: Dell OpenManage Enterprise · CVSS 8.1 High · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [SQL Injection in Faydam Innovation's FAYDAM Datalogger](https://agentprime.io/advisories/CVE-2026-16019.md) `CVE-2026-16019` · CVE record: Faydam Innovation Inc. FAYDAM Datalogger · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [SQL injection in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-56088.md) `CVE-2026-56088` · CVE record: Dell OpenManage Enterprise · CVSS 7.1 High · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64](https://agentprime.io/advisories/CVE-2026-74804.md) `CVE-2026-74804` · CVE record: yootheme.com Zoo extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [WordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-73391.md) `CVE-2026-73391` · CVE record: KlbTheme Total Donations · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [WordPress Nikstore Core plugin <= 1.5 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-73388.md) `CVE-2026-73388` · CVE record: TeconceTheme Nikstore Core · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [WordPress NGG Smart Image Search plugin < 4.0.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-73185.md) `CVE-2026-73185` · CVE record: wpo-HR NGG Smart Image Search · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [WordPress Maps Marker Pro plugin <= 4.32 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-73183.md) `CVE-2026-73183` · CVE record: Get Maps Marker Pro Maps Marker Pro · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [WordPress Community by PeepSo plugin <= 9.0.5.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66668.md) `CVE-2026-66668` · CVE record: PeepSo Community by PeepSo · CVSS 8.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-32552.md) `CVE-2026-32552` · CVE record: YITH YITH WooCommerce Membership Premium · CVSS 8.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection via get_shortlisted_products](https://agentprime.io/advisories/CVE-2026-16950.md) `CVE-2026-16950` · CVE record: Unknown Product Shortlist · CVSS 8.6 High · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [Dinatur <= 1.18 - Unauthenticated SQL Injection via Column Name Injection](https://agentprime.io/advisories/CVE-2026-12983.md) `CVE-2026-12983` · CVE record: Unknown Dinatur · CVSS 8.6 High · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [SourceCodester Simple Online Food Ordering System ajax.php delete_menu sql injection](https://agentprime.io/advisories/CVE-2026-76050.md) `CVE-2026-76050` · CVE record: SourceCodester Simple Online Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, SQL injection - [SourceCodester Simple Online Food Ordering System ajax.php save_menu sql injection](https://agentprime.io/advisories/CVE-2026-76049.md) `CVE-2026-76049` · CVE record: SourceCodester Simple Online Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, SQL injection - [SourceCodester Simple Online Food Ordering System ajax.php login sql injection](https://agentprime.io/advisories/CVE-2026-76048.md) `CVE-2026-76048` · CVE record: SourceCodester Simple Online Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, SQL injection - [code-projects Online Job Portal System Password Recovery ForPass.php sql injection](https://agentprime.io/advisories/CVE-2026-75986.md) `CVE-2026-75986` · CVE record: code-projects Online Job Portal System · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, SQL injection - [SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the api_vedo/chat endpoint and the utente_chat parameter](https://agentprime.io/advisories/CVE-2026-51366.md) `CVE-2026-51366` · CVE record · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection - [Froxlor: Second-Order SQL Injection via \`Admins.add\` \`ipaddress\` Parameter Allows Full Database Exfiltration](https://agentprime.io/advisories/GHSA-w27m-rmmf-g5w4.md) `GHSA-w27m-rmmf-g5w4`, `CVE-2026-54348`, `PKSA-tbmy-ntqq-5hz6` · Packagist `froxlor/froxlor`: affected `<2.3.8`, fixed in `2.3.8` · CVSS 7.2 High · Not analysed yet · Published 18 Aug 2026 · Tags: SQL injection - [xianrendzw EasyReport Move Operations ModuleController.java sql injection](https://agentprime.io/advisories/CVE-2026-75876.md) `CVE-2026-75876` · CVE record: xianrendzw EasyReport · CVSS 5.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection, SQL injection - [WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-74015.md) `CVE-2026-74015` · CVE record: merkulove Readabler · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: SQL injection - [WordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-73365.md) `CVE-2026-73365` · CVE record: Crocoblock. Jetimpex Inc. JetAppointment · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: SQL injection - [WordPress Affiliates Manager plugin <= 2.9.53 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-73355.md) `CVE-2026-73355` · CVE record: wp.insider Affiliates Manager · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: SQL injection - [WordPress License Manager for WooCommerce plugin <= 3.0.18 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-73345.md) `CVE-2026-73345` · CVE record: Saad Iqbal License Manager for WooCommerce · CVSS 7.1 High · Not analysed yet · Published 18 Aug 2026 · Tags: SQL injection - [WordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-73339.md) `CVE-2026-73339` · CVE record: Webnus Inc. Modern Events Calendar · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: SQL injection - [WordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-73187.md) `CVE-2026-73187` · CVE record: gingerplugins Sticky Chat Widget · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: SQL injection - [WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66622.md) `CVE-2026-66622` · CVE record: averta Depicter Slider · CVSS 7.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: SQL injection - [WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-32466.md) `CVE-2026-32466` · CVE record: WPExperts Gravity Forms Bookings premium · CVSS 8.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: SQL injection - [code-projects Task Management System Login Form index.php select_with_multiple_condition sql injection](https://agentprime.io/advisories/CVE-2026-75778.md) `CVE-2026-75778` · CVE record: code-projects Task Management System · CVSS 6.9 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection, SQL injection - [PHPGurukul Complaint Management System check_availability.php sql injection](https://agentprime.io/advisories/CVE-2026-75089.md) `CVE-2026-75089` · CVE record: PHPGurukul Complaint Management System · CVSS 6.9 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Hospital Management System viewbilling.php sql injection](https://agentprime.io/advisories/CVE-2026-75088.md) `CVE-2026-75088` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Hospital Management System viewdepartment.php sql injection](https://agentprime.io/advisories/CVE-2026-75087.md) `CVE-2026-75087` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Hospital Management System viewroom.php sql injection](https://agentprime.io/advisories/CVE-2026-75086.md) `CVE-2026-75086` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection, SQL injection - [SourceCodester Class and Exam Timetabling System edit_subject1.php sql injection](https://agentprime.io/advisories/CVE-2026-75080.md) `CVE-2026-75080` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Other injection, SQL injection - [SourceCodester Class and Exam Timetabling System edit_subject2.php sql injection](https://agentprime.io/advisories/CVE-2026-75079.md) `CVE-2026-75079` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Other injection, SQL injection - [ERPNext: SQL Injection in "Inactive Customers" report via unvalidated \`doctype\` filter](https://agentprime.io/advisories/CVE-2026-65822.md) `CVE-2026-65822` · CVE record: frappe erpnext · CVSS 7.6 High · Not analysed yet · Published 17 Aug 2026 · Tags: SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .