# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [itsourcecode Sales and Inventory System settings_edit.php sql injection](https://agentprime.io/advisories/CVE-2026-86270.md) `CVE-2026-86270` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System emp_edit1.php sql injection](https://agentprime.io/advisories/CVE-2026-86269.md) `CVE-2026-86269` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode School Management System User_Login.php sql injection](https://agentprime.io/advisories/CVE-2026-86268.md) `CVE-2026-86268` · CVE record: itsourcecode School Management System · CVSS 6.9 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Information System Society Membership System check_student.php sql injection](https://agentprime.io/advisories/CVE-2026-86267.md) `CVE-2026-86267` · CVE record: itsourcecode Information System Society Membership System · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System us_transac.php sql injection](https://agentprime.io/advisories/CVE-2026-86265.md) `CVE-2026-86265` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System sup_transac.php sql injection](https://agentprime.io/advisories/CVE-2026-86245.md) `CVE-2026-86245` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System pro_transac.php add sql injection](https://agentprime.io/advisories/CVE-2026-86236.md) `CVE-2026-86236` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System pos_transac.php add sql injection](https://agentprime.io/advisories/CVE-2026-86235.md) `CVE-2026-86235` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System cust_transac.php add sql injection](https://agentprime.io/advisories/CVE-2026-86234.md) `CVE-2026-86234` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System us_del.php sql injection](https://agentprime.io/advisories/CVE-2026-86233.md) `CVE-2026-86233` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System sup_del.php sql injection](https://agentprime.io/advisories/CVE-2026-86232.md) `CVE-2026-86232` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Class and Exam Timetabling System modal_add_room.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-86225.md) `CVE-2026-86225` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Class and Exam Timetabling System modal_add_product.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-86224.md) `CVE-2026-86224` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Class and Exam Timetabling System modal_add_coursea.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-86223.md) `CVE-2026-86223` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Class and Exam Timetabling System modal_add_course2.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-86222.md) `CVE-2026-86222` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Class and Exam Timetabling System modal_add_course1.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-86221.md) `CVE-2026-86221` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Class and Exam Timetabling System modal_add_course.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-86220.md) `CVE-2026-86220` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [PostgreSQL Anonymizer: SQL injection in import_database_rules() and import_roles_rules() via crafted object names / JSON](https://agentprime.io/advisories/CVE-2026-19634.md) `CVE-2026-19634` · CVE record: DALIBO PostgreSQL Anonymizer · CVSS 6.4 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: SQL injection - [PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries](https://agentprime.io/advisories/CVE-2026-19633.md) `CVE-2026-19633` · CVE record: DALIBO PostgreSQL Anonymizer · CVSS 8.8 High · Not analysed yet · Published 6 Sept 2026 · Tags: SQL injection - [Mstfakts College-Management-System Search university.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-86213.md) `CVE-2026-86213` · CVE record: Mstfakts College-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [rabindralamsal inventory-management-system Login index.php sql injection](https://agentprime.io/advisories/CVE-2026-86211.md) `CVE-2026-86211` · CVE record: rabindralamsal inventory-management-system · CVSS 6.9 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Class and Exam Timetabling System delete_user_account.php sql injection](https://agentprime.io/advisories/CVE-2026-86210.md) `CVE-2026-86210` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Class and Exam Timetabling System delete_user.php sql injection](https://agentprime.io/advisories/CVE-2026-86209.md) `CVE-2026-86209` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Class and Exam Timetabling System delete_teacher.php sql injection](https://agentprime.io/advisories/CVE-2026-86208.md) `CVE-2026-86208` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 6.9 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [code-projects Task Management System In PHP Login index.php sql injection](https://agentprime.io/advisories/CVE-2026-86180.md) `CVE-2026-86180` · CVE record: code-projects Task Management System In PHP · CVSS 6.9 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [DefaultFuction CRM delete.php sql injection](https://agentprime.io/advisories/CVE-2026-86172.md) `CVE-2026-86172` · CVE record: DefaultFuction CRM · CVSS 5.3 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [DefaultFuction CRM delete.php sql injection](https://agentprime.io/advisories/CVE-2026-86171.md) `CVE-2026-86171` · CVE record: DefaultFuction CRM · CVSS 5.3 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [DefaultFuction CRM edit.php sql injection](https://agentprime.io/advisories/CVE-2026-86170.md) `CVE-2026-86170` · CVE record: DefaultFuction CRM · CVSS 5.3 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [code-projects Content Management System login.php sql injection](https://agentprime.io/advisories/CVE-2026-86168.md) `CVE-2026-86168` · CVE record: code-projects Content Management System · CVSS 6.9 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System trans_view.php sql injection](https://agentprime.io/advisories/CVE-2026-86164.md) `CVE-2026-86164` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System pro_del.php sql injection](https://agentprime.io/advisories/CVE-2026-86163.md) `CVE-2026-86163` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Voting System ajax.php login sql injection](https://agentprime.io/advisories/CVE-2026-86162.md) `CVE-2026-86162` · CVE record: SourceCodester Online Voting System · CVSS 6.9 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Voting System ajax.php delete_category sql injection](https://agentprime.io/advisories/CVE-2026-86161.md) `CVE-2026-86161` · CVE record: SourceCodester Online Voting System · CVSS 6.9 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Voting System ajax.php delete_voting sql injection](https://agentprime.io/advisories/CVE-2026-86160.md) `CVE-2026-86160` · CVE record: SourceCodester Online Voting System · CVSS 6.9 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Voting System ajax.php save_user sql injection](https://agentprime.io/advisories/CVE-2026-86159.md) `CVE-2026-86159` · CVE record: SourceCodester Online Voting System · CVSS 6.9 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Other injection, SQL injection - [YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax](https://agentprime.io/advisories/CVE-2026-84937.md) `CVE-2026-84937` · CVE record: Unknown Video Player for YouTube · CVSS 6.8 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: SQL injection - [Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID](https://agentprime.io/advisories/CVE-2026-84221.md) `CVE-2026-84221` · CVE record: Unknown Kirki · CVSS 6.8 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: SQL injection - [Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler](https://agentprime.io/advisories/CVE-2026-82304.md) `CVE-2026-82304` · CVE record: Unknown Music Store · CVSS 8.6 High · Not analysed yet · Published 5 Sept 2026 · Tags: SQL injection - [code-projects Online Shopping System adduser.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-85643.md) `CVE-2026-85643` · CVE record: code-projects Online Shopping System · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Other injection, SQL injection - [Emlog Blind SQL Injection via Authentication Cookie](https://agentprime.io/advisories/CVE-2026-53756.md) `CVE-2026-53756` · CVE record: emlog emlog · CVSS 4.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: SQL injection - [ILIAS Arbitrary SQL Injection via Repository Trash Table Sort Parameter](https://agentprime.io/advisories/CVE-2026-82538.md) `CVE-2026-82538` · CVE record: ILIAS-eLearning e.V. ILIAS · CVSS 8.7 High · Not analysed yet · Published 4 Sept 2026 · Tags: SQL injection - [IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed](https://agentprime.io/advisories/CVE-2026-18658.md) `CVE-2026-18658` · CVE record: IBM Operational Decision Manager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: SQL injection - [llmware 0.4.6 SQL Injection via unescaped filter values](https://agentprime.io/advisories/CVE-2026-85689.md) `CVE-2026-85689` · CVE record: llmware-ai llmware · CVSS 7.1 High · Not analysed yet · Published 4 Sept 2026 · Tags: SQL injection - [Apache Griffin Hive Metastore Module: SQL Injection Vulnerability in Hive Metastore Module](https://agentprime.io/advisories/CVE-2026-52691.md) `CVE-2026-52691` · CVE record: Apache Software Foundation Apache Griffin Hive Metastore Module · CVSS 8.8 High · Not analysed yet · Published 4 Sept 2026 · Tags: SQL injection - [code-projects Vehicle Management System busprofile.php sql injection](https://agentprime.io/advisories/CVE-2026-85516.md) `CVE-2026-85516` · CVE record: code-projects Vehicle Management System · CVSS 6.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Other injection, SQL injection - [SQL Injection in TAC Information's GoldenHorn](https://agentprime.io/advisories/CVE-2026-18198.md) `CVE-2026-18198` · CVE record: TAC Information Services Internal and External Trade Inc. GOLDENHORN ONEIT · CVSS 8.8 High · Not analysed yet · Published 4 Sept 2026 · Tags: SQL injection - [Interinfo｜DreamMaker - SQL Injection](https://agentprime.io/advisories/CVE-2026-85540.md) `CVE-2026-85540` · CVE record: Interinfo DreamMaker · CVSS 8.7 High · Not analysed yet · Published 4 Sept 2026 · Tags: SQL injection - [WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57777.md) `CVE-2026-57777` · CVE record: Automattic WooCommerce · CVSS 7.6 High · Not analysed yet · Published 4 Sept 2026 · Tags: SQL injection - [WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter](https://agentprime.io/advisories/CVE-2026-82186.md) `CVE-2026-82186` · CVE record: Unknown WPLP Cookie Consent · CVSS 4.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: SQL injection - [code-projects Doctor Appointment System contactus.php sql injection](https://agentprime.io/advisories/CVE-2026-85403.md) `CVE-2026-85403` · CVE record: code-projects Doctor Appointment System · CVSS 6.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Other injection, SQL injection - [code-projects Doctor Appointment System booking.php sql injection](https://agentprime.io/advisories/CVE-2026-85402.md) `CVE-2026-85402` · CVE record: code-projects Doctor Appointment System · CVSS 6.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Other injection, SQL injection - [code-projects Hospital Information System PrespController.php getSinglePresp sql injection](https://agentprime.io/advisories/CVE-2026-85399.md) `CVE-2026-85399` · CVE record: code-projects Hospital Information System · CVSS 6.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Other injection, SQL injection - [code-projects Hospital Information System viewReq.php viewReq sql injection](https://agentprime.io/advisories/CVE-2026-85398.md) `CVE-2026-85398` · CVE record: code-projects Hospital Information System · CVSS 6.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Other injection, SQL injection - [code-projects Hospital Information System addReq.php findBySearch sql injection](https://agentprime.io/advisories/CVE-2026-85397.md) `CVE-2026-85397` · CVE record: code-projects Hospital Information System · CVSS 6.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System inv_del.php sql injection](https://agentprime.io/advisories/CVE-2026-85383.md) `CVE-2026-85383` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Other injection, SQL injection - [light0011 cms Query Builder ChapterController.class.php searchChapter sql injection](https://agentprime.io/advisories/CVE-2026-85379.md) `CVE-2026-85379` · CVE record: light0011 cms · CVSS 6.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Other injection, SQL injection - [SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensitive information via the User.php component](https://agentprime.io/advisories/CVE-2026-71622.md) `CVE-2026-71622` · CVE record · CVSS 7.4 High · Not analysed yet · Published 4 Sept 2026 · Tags: SQL injection - [SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path](https://agentprime.io/advisories/CVE-2025-67066.md) `CVE-2025-67066` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: SQL injection - [SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel](https://agentprime.io/advisories/GHSA-x67c-8pwr-m8g3.md) `GHSA-x67c-8pwr-m8g3`, `CVE-2026-72807`, `GO-2026-6410` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260723035036-0a176345e02a`, fixed in `0.0.0-20260723035036-0a176345e02a` · CVSS 8.8 High · Not analysed yet · Published 3 Sept 2026 · Tags: SQL injection, Code injection - [SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle](https://agentprime.io/advisories/GHSA-q2vg-7qgx-x5fc.md) `GHSA-q2vg-7qgx-x5fc`, `CVE-2026-72811`, `GO-2026-6402` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260723004839-1a5b3431d5ab`, fixed in `0.0.0-20260723004839-1a5b3431d5ab` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .