# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [itsourcecode Sales and Inventory System sup_edit.php sql injection](https://agentprime.io/advisories/CVE-2026-82541.md) `CVE-2026-82541` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System cust_searchfrm.php sql injection](https://agentprime.io/advisories/CVE-2026-82540.md) `CVE-2026-82540` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System pro_edit.php sql injection](https://agentprime.io/advisories/CVE-2026-82485.md) `CVE-2026-82485` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System emp_searchfrm.php sql injection](https://agentprime.io/advisories/CVE-2026-82484.md) `CVE-2026-82484` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Other injection, SQL injection - [PHPGurukul Student Information System student_edit1.php sql injection](https://agentprime.io/advisories/CVE-2026-82424.md) `CVE-2026-82424` · CVE record: PHPGurukul Student Information System · CVSS 5.3 Medium · Not analysed yet · Published 29 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System emp_del.php sql injection](https://agentprime.io/advisories/CVE-2026-82422.md) `CVE-2026-82422` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 29 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System emp_edit.php sql injection](https://agentprime.io/advisories/CVE-2026-82421.md) `CVE-2026-82421` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 29 Aug 2026 · Tags: Other injection, SQL injection - [WP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import Fields](https://agentprime.io/advisories/CVE-2026-80488.md) `CVE-2026-80488` · CVE record: Unknown WP Ultimate CSV Importer · CVSS 4.1 Medium · Not analysed yet · Published 29 Aug 2026 · Tags: SQL injection - [Rest Routes <= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table_name}](https://agentprime.io/advisories/CVE-2026-16061.md) `CVE-2026-16061` · CVE record: Unknown Rest Routes · CVSS 8.6 High · Not analysed yet · Published 29 Aug 2026 · Tags: SQL injection - [MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets](https://agentprime.io/advisories/GHSA-g5xc-5w98-jfvm.md) `GHSA-g5xc-5w98-jfvm`, `BIT-mariadb-2026-55855`, `BIT-mariadb-min-2026-55855`, `BIT-mysql-client-2026-55855`, `CVE-2026-55855` · npm `mariadb`: affected `<3.2.4 || >=3.3.0, <3.3.4 || >=3.4.0, <3.4.6 || >=3.5.0, <3.5.3`, fixed in `3.2.4`, `3.3.4`, `3.4.6`, `3.5.3` · CVSS 6.5 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: SQL injection, CWE-116 - [Multiple Vulnerabilities in IBM Concert Software](https://agentprime.io/advisories/CVE-2026-3627.md) `CVE-2026-3627` · CVE record: IBM Concert · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2026 · Tags: SQL injection - [MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE Output](https://agentprime.io/advisories/CVE-2026-77586.md) `CVE-2026-77586` · CVE record: MongoDB BI Connector · CVSS 8.5 High · Not analysed yet · Published 28 Aug 2026 · Tags: SQL injection - [MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE Output](https://agentprime.io/advisories/CVE-2026-77184.md) `CVE-2026-77184` · CVE record: MongoDB BI Connector · CVSS 5.6 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: SQL injection - [Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name](https://agentprime.io/advisories/GHSA-9x44-4gxf-8c25.md) `GHSA-9x44-4gxf-8c25`, `CVE-2026-55634`, `PKSA-vgg9-cbdg-s4xt` · Packagist `pimcore/pimcore`: affected `<12.3.10 || >=2026.1.0, <2026.1.6`, fixed in `12.3.10`, `2026.1.6` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2026 · Tags: SQL injection, Code injection - [Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes](https://agentprime.io/advisories/GHSA-79cw-hfcc-7mw9.md) `GHSA-79cw-hfcc-7mw9`, `CVE-2026-55208`, `PKSA-pq1q-v29r-6xp5` · Packagist `pimcore/studio-backend-bundle`: affected `<2025.4.6 || >=2026.1.0, <2026.1.6`, fixed in `2025.4.6`, `2026.1.6` · CVSS 7.7 High · Not analysed yet · Published 28 Aug 2026 · Tags: SQL injection - [WsgiDAV MySQL provider has a blind SQL injection](https://agentprime.io/advisories/GHSA-p6gw-4frg-j7jw.md) `GHSA-p6gw-4frg-j7jw`, `CVE-2026-55509`, `PYSEC-2026-3945` · PyPI `wsgidav`: affected `<4.3.5`, fixed in `4.3.5` · CVSS 8.8 High · Not analysed yet · Published 28 Aug 2026 · Tags: SQL injection - [WordPress WPBulky plugin <= 1.2.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-82227.md) `CVE-2026-82227` · CVE record: VillaTheme WPBulky · CVSS 8.5 High · Not analysed yet · Published 28 Aug 2026 · Tags: SQL injection - [SQL injection in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-40018.md) `CVE-2026-40018` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 7.4 High · Not analysed yet · Published 28 Aug 2026 · Tags: SQL injection - [Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded < 5.6.1](https://agentprime.io/advisories/CVE-2026-78072.md) `CVE-2026-78072` · CVE record: Jefferson49 Sexy Polling Reloaded extension for Joomla · CVSS 8.7 High · Not analysed yet · Published 28 Aug 2026 · Tags: SQL injection - [Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2](https://agentprime.io/advisories/CVE-2026-78070.md) `CVE-2026-78070` · CVE record: digital-peak.com DP Calendar extension for Joomla · CVSS 6.9 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: SQL injection - [wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter](https://agentprime.io/advisories/CVE-2026-5097.md) `CVE-2026-5097` · CVE record: tomdever wpForo Forum · CVSS 7.5 High · Not analysed yet · Published 28 Aug 2026 · Tags: SQL injection - [Dimension SQL Injection in Scheduled Report](https://agentprime.io/advisories/CVE-2026-78612.md) `CVE-2026-78612` · CVE record: WatchGuard Dimension · CVSS 8.6 High · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection, Insecure deserialization - [Dimension SQL Injection in Log Viewer](https://agentprime.io/advisories/CVE-2026-78613.md) `CVE-2026-78613` · CVE record: WatchGuard Dimension · CVSS 8.6 High · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection - [Dimension SQL Injection in Audit Report](https://agentprime.io/advisories/CVE-2026-78614.md) `CVE-2026-78614` · CVE record: WatchGuard Dimension · CVSS 8.6 High · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection, Insecure deserialization - [Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys](https://agentprime.io/advisories/CVE-2026-81728.md) `CVE-2026-81728` · CVE record: Dolibarr dolibarr · CVSS 8.6 High · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection - [Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause](https://agentprime.io/advisories/CVE-2026-74820.md) `CVE-2026-74820` · CVE record: ServiceNow ServiceNow AI Platform · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection - [Multiple Vulnerabilities in TOOOLS' iSquad](https://agentprime.io/advisories/CVE-2026-81677.md) `CVE-2026-81677` · CVE record: TOOOLS iSquad · CVSS 8.8 High · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection - [Multiple Vulnerabilities in TOOOLS' iSquad](https://agentprime.io/advisories/CVE-2026-81676.md) `CVE-2026-81676` · CVE record: TOOOLS iSquad · CVSS 8.8 High · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection - [Multiple Vulnerabilities in TOOOLS' iSquad](https://agentprime.io/advisories/CVE-2026-81675.md) `CVE-2026-81675` · CVE record: TOOOLS iSquad · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection - [Multiple Vulnerabilities in TOOOLS' iSquad](https://agentprime.io/advisories/CVE-2026-81674.md) `CVE-2026-81674` · CVE record: TOOOLS iSquad · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection - [Multiple Vulnerabilities in TOOOLS' iSquad](https://agentprime.io/advisories/CVE-2026-81673.md) `CVE-2026-81673` · CVE record: TOOOLS iSquad · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection - [Multiple Vulnerabilities in TOOOLS' iSquad](https://agentprime.io/advisories/CVE-2026-81672.md) `CVE-2026-81672` · CVE record: TOOOLS iSquad · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection - [WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-81277.md) `CVE-2026-81277` · CVE record: VillaTheme Suggestion Engine for WooCommerce · CVSS 8.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection - [WordPress Beautiful Taxonomy Filters plugin <= 2.4.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-78288.md) `CVE-2026-78288` · CVE record: Jonathan de Jong Beautiful Taxonomy Filters · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection - [WordPress Like Button Rating plugin <= 2.6.61 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-78285.md) `CVE-2026-78285` · CVE record: LikeBtn Like Button Rating · CVSS 8.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection - [WordPress Epayco plugin <= 8.4.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-78260.md) `CVE-2026-78260` · CVE record: ePayco Epayco · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection - [WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-32564.md) `CVE-2026-32564` · CVE record: ACPT ACPT (Pro) - Custom Post Types Plugin for WordPress · CVSS 8.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection - [WordPress Kadence Shop Kit plugin <= 3.0.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-32550.md) `CVE-2026-32550` · CVE record: Liquid Web, LLC Kadence Shop Kit · CVSS 8.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection - [WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-32479.md) `CVE-2026-32479` · CVE record: CODEPRESS IT Solutions LLC Visitor Traffic Real Time Statistics Pro · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection - [A SQL injection vulnerability was found in YzmCMS 7.5.](https://agentprime.io/advisories/CVE-2026-75417.md) `CVE-2026-75417` · CVE record · CVSS 7.2 High · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection - [A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sql_query argument.](https://agentprime.io/advisories/CVE-2026-37009.md) `CVE-2026-37009` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection - [SourceCodester Simple Online Food Ordering System ajax.php login2 sql injection](https://agentprime.io/advisories/CVE-2026-81203.md) `CVE-2026-81203` · CVE record: SourceCodester Simple Online Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Other injection, SQL injection - [SQL injection in Dell Power Protect Cyber Recovery and others](https://agentprime.io/advisories/CVE-2026-49809.md) `CVE-2026-49809` · CVE record: Dell Power Protect Cyber Recovery and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: SQL injection - [Thinking Software Technology｜Efence - SQL Injection](https://agentprime.io/advisories/CVE-2026-80236.md) `CVE-2026-80236` · CVE record: Thinking Software Technology Efence · CVSS 8.8 High · Not analysed yet · Published 26 Aug 2026 · Tags: SQL injection - [SQL injection vulnerability in ZTE SCP product](https://agentprime.io/advisories/CVE-2026-9668.md) `CVE-2026-9668` · CVE record: ZTE SCP · CVSS 6.3 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: SQL injection - [WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters](https://agentprime.io/advisories/CVE-2026-18884.md) `CVE-2026-18884` · CVE record: wpgenie WooCommerce Lottery · CVSS 7.5 High · Not analysed yet · Published 26 Aug 2026 · Tags: SQL injection - [RegistrationMagic < 6.0.9.4 - Admin+ SQLi via 'rm_sortby' Parameter](https://agentprime.io/advisories/CVE-2026-77790.md) `CVE-2026-77790` · CVE record: Unknown RegistrationMagic · CVSS 5.5 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: SQL injection - [Tutor LMS < 4.0.6 - Unauthenticated SQLi via 'offset' and 'item_per_page' Parameters](https://agentprime.io/advisories/CVE-2026-19094.md) `CVE-2026-19094` · CVE record: Unknown Tutor LMS · CVSS 5.3 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: SQL injection - [Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.json.](https://agentprime.io/advisories/CVE-2026-75336.md) `CVE-2026-75336` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: SQL injection - [The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution.](https://agentprime.io/advisories/CVE-2026-75334.md) `CVE-2026-75334` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: SQL injection - [The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection.](https://agentprime.io/advisories/CVE-2026-75330.md) `CVE-2026-75330` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: SQL injection - [The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection.](https://agentprime.io/advisories/CVE-2026-68000.md) `CVE-2026-68000` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: SQL injection - [An issue was discovered in LibreNMS 1.65.](https://agentprime.io/advisories/CVE-2020-15878.md) `CVE-2020-15878` · CVE record · CVSS 8.8 High · Not analysed yet · Published 26 Aug 2026 · Tags: SQL injection - [An issue was discovered in LibreNMS 1.65.](https://agentprime.io/advisories/CVE-2020-15876.md) `CVE-2020-15876` · CVE record · CVSS 8.8 High · Not analysed yet · Published 26 Aug 2026 · Tags: SQL injection - [code-projects Simple Inventory System edit.php sql injection](https://agentprime.io/advisories/CVE-2026-79845.md) `CVE-2026-79845` · CVE record: code-projects Simple Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Other injection, SQL injection - [SililaWijesinghe Food Ordering System search.php sql injection](https://agentprime.io/advisories/CVE-2026-79804.md) `CVE-2026-79804` · CVE record: SililaWijesinghe Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Other injection, SQL injection - [Webkul QloApps SQL injection](https://agentprime.io/advisories/CVE-2026-75498.md) `CVE-2026-75498` · CVE record: Webkul QloApps · CVSS 8.6 High · Not analysed yet · Published 25 Aug 2026 · Tags: SQL injection - [Webkul QloApps SQL injection](https://agentprime.io/advisories/CVE-2026-75497.md) `CVE-2026-75497` · CVE record: Webkul QloApps · CVSS 8.6 High · Not analysed yet · Published 25 Aug 2026 · Tags: SQL injection - [liketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injection](https://agentprime.io/advisories/CVE-2026-78864.md) `CVE-2026-78864` · CVE record: liketrek TREK · CVSS 5.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Other injection, SQL injection - [Media Sweep <= 1.1.3 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter](https://agentprime.io/advisories/CVE-2026-77824.md) `CVE-2026-77824` · CVE record: wpcreatix Media Sweep – WordPress Media Cleaner · CVSS 4.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .