# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [SQL injection in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87238.md) `CVE-2026-87238` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: SQL injection - [SQL injection in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87212.md) `CVE-2026-87212` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 7.4 High · Not analysed yet · Published 15 Sept 2026 · Tags: SQL injection - [SQL injection in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87207.md) `CVE-2026-87207` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 7.2 High · Not analysed yet · Published 15 Sept 2026 · Tags: SQL injection - [SQL injection in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87202.md) `CVE-2026-87202` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: SQL injection - [SQL injection in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87184.md) `CVE-2026-87184` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: SQL injection - [SQL injection in Oracle Corporation Siebel CRM Deployment](https://agentprime.io/advisories/CVE-2026-83210.md) `CVE-2026-83210` · CVE record: Oracle Corporation Siebel CRM Deployment · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: SQL injection - [SQL injection in Oracle Corporation Siebel CRM Deployment](https://agentprime.io/advisories/CVE-2026-83208.md) `CVE-2026-83208` · CVE record: Oracle Corporation Siebel CRM Deployment · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: SQL injection - [Netmaker has a boolean‑based SQL Injection](https://agentprime.io/advisories/GHSA-r8cr-4f9w-7r75.md) `GHSA-r8cr-4f9w-7r75`, `CVE-2026-32599`, `GO-2026-6485` · Go `github.com/gravitl/netmaker`: affected `<1.5.0`, fixed in `1.5.0` · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: SQL injection - [Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7](https://agentprime.io/advisories/CVE-2026-81567.md) `CVE-2026-81567` · CVE record: j2commerce.com J2Store extension for Joomla · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: SQL injection - [Yonyou U8 CRM SQL Injection via fillbacksettingedit.php](https://agentprime.io/advisories/CVE-2024-58385.md) `CVE-2024-58385` · CVE record: Yonyou U8 CRM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: SQL injection - [Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Document Library Block via \`fsID\[\]\` in \`setMode=any\`](https://agentprime.io/advisories/CVE-2026-81895.md) `CVE-2026-81895` · CVE record: Concrete CMS Concrete CMS · CVSS 8.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: SQL injection - [Concrete CMS 9.5.2 and below is vulnerable to Stored DOM-based Cross-site Scripting (XSS) in the Gallery block image Caption field](https://agentprime.io/advisories/CVE-2026-81894.md) `CVE-2026-81894` · CVE record: Concrete CMS Concrete CMS · CVSS 8.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: SQL injection - [WuzhiCMS index.php getDataOfJson sql injection](https://agentprime.io/advisories/CVE-2026-91848.md) `CVE-2026-91848` · CVE record: WuzhiCMS · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Faculty Clearance System delete_faculty1.php sql injection](https://agentprime.io/advisories/CVE-2026-91004.md) `CVE-2026-91004` · CVE record: SourceCodester Online Faculty Clearance System · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, SQL injection - [WP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget Settings](https://agentprime.io/advisories/CVE-2026-16593.md) `CVE-2026-16593` · CVE record: Unknown WP Directory Kit · CVSS 6.8 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: SQL injection - [zyx0814 FilePress Publish search.php sql injection](https://agentprime.io/advisories/CVE-2026-90879.md) `CVE-2026-90879` · CVE record: zyx0814 FilePress · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Faculty Clearance System update_requirement_status.php sql injection](https://agentprime.io/advisories/CVE-2026-90877.md) `CVE-2026-90877` · CVE record: SourceCodester Online Faculty Clearance System · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Faculty Clearance System delete_requirement.php sql injection](https://agentprime.io/advisories/CVE-2026-90876.md) `CVE-2026-90876` · CVE record: SourceCodester Online Faculty Clearance System · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester/katojkalemba Online Food Ordering System order.php sql injection](https://agentprime.io/advisories/CVE-2026-90855.md) `CVE-2026-90855` · CVE record: SourceCodester Online Food Ordering System and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester/katojkalemba Online Food Ordering System category-foods.php sql injection](https://agentprime.io/advisories/CVE-2026-90854.md) `CVE-2026-90854` · CVE record: SourceCodester Online Food Ordering System and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester College Notes Gallery Management System login.php sql injection](https://agentprime.io/advisories/CVE-2026-90849.md) `CVE-2026-90849` · CVE record: SourceCodester College Notes Gallery Management System · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, SQL injection - [PHPGurukul Daily Expense Tracker System forgot-password.php sql injection](https://agentprime.io/advisories/CVE-2026-90846.md) `CVE-2026-90846` · CVE record: PHPGurukul Daily Expense Tracker System · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, SQL injection - [PHPGurukul Daily Expense Tracker System Login index.php sql injection](https://agentprime.io/advisories/CVE-2026-90844.md) `CVE-2026-90844` · CVE record: PHPGurukul Daily Expense Tracker System · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, SQL injection - [kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection.](https://agentprime.io/advisories/CVE-2026-79303.md) `CVE-2026-79303` · CVE record · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: SQL injection - [PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection](https://agentprime.io/advisories/CVE-2026-90841.md) `CVE-2026-90841` · CVE record: PHPGurukul Blood Donor Management System · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection, SQL injection - [Magistrala < 1.0.0 SQL Injection via format Parameter in Reader API](https://agentprime.io/advisories/CVE-2026-82028.md) `CVE-2026-82028` · CVE record: absmach magistrala · CVSS 8.7 High · Not analysed yet · Published 14 Sept 2026 · Tags: SQL injection - [subhajitkhan online-clinic-management-system doctorlogin.php sql injection](https://agentprime.io/advisories/CVE-2026-90805.md) `CVE-2026-90805` · CVE record: subhajitkhan online-clinic-management-system · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection, SQL injection - [Cisco Secure Email Gateway SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-76461.md) `CVE-2026-76461` · CVE record: Cisco Cisco Secure Email · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.40 · Not analysed yet · Published 14 Sept 2026 · Tags: SQL injection - [itsourcecode Leave Management System index.php sql injection](https://agentprime.io/advisories/CVE-2026-90796.md) `CVE-2026-90796` · CVE record: itsourcecode Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Leave Management System login.php sql injection](https://agentprime.io/advisories/CVE-2026-90789.md) `CVE-2026-90789` · CVE record: itsourcecode Leave Management System · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection, SQL injection - [SQL Injection in Alior Bank raty PrestaShop module](https://agentprime.io/advisories/CVE-2026-15600.md) `CVE-2026-15600` · CVE record: Alior Bank raty · CVSS 8.6 High · Not analysed yet · Published 14 Sept 2026 · Tags: SQL injection - [SQL Injection in Alior Bank raty PrestaShop module](https://agentprime.io/advisories/CVE-2026-7848.md) `CVE-2026-7848` · CVE record: Alior Bank raty · CVSS 8.6 High · Not analysed yet · Published 14 Sept 2026 · Tags: SQL injection - [Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search](https://agentprime.io/advisories/CVE-2026-77051.md) `CVE-2026-77051` · CVE record: Apache Software Foundation Apache Syncope · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: SQL injection - [Yot CMS Cookie global.php login sql injection](https://agentprime.io/advisories/CVE-2026-90708.md) `CVE-2026-90708` · CVE record: Yot CMS · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection, SQL injection - [Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0](https://agentprime.io/advisories/CVE-2026-78375.md) `CVE-2026-78375` · CVE record: joomshaper.com SP Page Builder (Free and Pro) extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 14 Sept 2026 · Tags: SQL injection - [Apache Syncope: SQL injection via sort parameter in Task search](https://agentprime.io/advisories/CVE-2026-82232.md) `CVE-2026-82232` · CVE record: Apache Software Foundation Apache Syncope · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: SQL injection - [Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence](https://agentprime.io/advisories/CVE-2026-86460.md) `CVE-2026-86460` · CVE record: Apache Software Foundation Apache Syncope · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: SQL injection - [Thinking Software Technology｜EFence - SQL Injection](https://agentprime.io/advisories/CVE-2026-89180.md) `CVE-2026-89180` · CVE record: Thinking Software Technology EFence · CVSS 8.7 High · Not analysed yet · Published 14 Sept 2026 · Tags: SQL injection - [subhajitkhan online-clinic-management-system listdoctor.php sql injection](https://agentprime.io/advisories/CVE-2026-90701.md) `CVE-2026-90701` · CVE record: subhajitkhan online-clinic-management-system · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System pro_edit1.php sql injection](https://agentprime.io/advisories/CVE-2026-90700.md) `CVE-2026-90700` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System inv_edit1.php sql injection](https://agentprime.io/advisories/CVE-2026-90600.md) `CVE-2026-90600` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System sup_edit1.php sql injection](https://agentprime.io/advisories/CVE-2026-90597.md) `CVE-2026-90597` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System emp_transac.php add sql injection](https://agentprime.io/advisories/CVE-2026-90574.md) `CVE-2026-90574` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester School Registration and Fee System save_class.php sql injection](https://agentprime.io/advisories/CVE-2026-90526.md) `CVE-2026-90526` · CVE record: SourceCodester School Registration and Fee System · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales and Inventory System cust_pos_trans.php sql injection](https://agentprime.io/advisories/CVE-2026-90525.md) `CVE-2026-90525` · CVE record: itsourcecode Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester School Registration and Fee System pay_report.php sql injection](https://agentprime.io/advisories/CVE-2026-90516.md) `CVE-2026-90516` · CVE record: SourceCodester School Registration and Fee System · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester School Registration and Fee System delete_stud.php sql injection](https://agentprime.io/advisories/CVE-2026-90515.md) `CVE-2026-90515` · CVE record: SourceCodester School Registration and Fee System · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester School Registration and Fee System save_stud.php sql injection](https://agentprime.io/advisories/CVE-2026-90514.md) `CVE-2026-90514` · CVE record: SourceCodester School Registration and Fee System · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection - [GongShengyue OnlineBooks listSplit BooksServlet.java sql injection](https://agentprime.io/advisories/CVE-2026-90511.md) `CVE-2026-90511` · CVE record: GongShengyue OnlineBooks · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection - [Fengoffice Feng Office Reorder Handlers MoreController.class.php update_dimension_order sql injection](https://agentprime.io/advisories/CVE-2026-90496.md) `CVE-2026-90496` · CVE record: Fengoffice Feng Office · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection - [Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injection](https://agentprime.io/advisories/CVE-2026-90495.md) `CVE-2026-90495` · CVE record: Fengoffice Feng Office · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, SQL injection - [SQL injection in LuxSoft LuxCal Web Calendar](https://agentprime.io/advisories/CVE-2026-36989.md) `CVE-2026-36989` · CVE record: LuxSoft LuxCal Web Calendar · CVSS 5.8 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: SQL injection - [SQL injection in LibreNMS](https://agentprime.io/advisories/CVE-2020-15875.md) `CVE-2020-15875` · CVE record: LibreNMS LibreNMS · CVSS 5.0 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: SQL injection - [Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name](https://agentprime.io/advisories/CVE-2026-77161.md) `CVE-2026-77161` · CVE record: egoi Smart Marketing SMS and Newsletters Forms · CVSS 6.5 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: SQL injection - [MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path](https://agentprime.io/advisories/CVE-2026-85198.md) `CVE-2026-85198` · CVE record: themeisle MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO · CVSS 6.5 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: SQL injection - [rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameter](https://agentprime.io/advisories/CVE-2026-16482.md) `CVE-2026-16482` · CVE record: rtcamp rtMedia for WordPress, BuddyPress and bbPress · CVSS 7.5 High · Not analysed yet · Published 12 Sept 2026 · Tags: SQL injection - [Album Cover Finder <= 0.7.0 - Unauthenticated SQLi via and_action](https://agentprime.io/advisories/CVE-2026-84047.md) `CVE-2026-84047` · CVE record: Unknown Album Cover Finder · CVSS 8.6 High · Not analysed yet · Published 12 Sept 2026 · Tags: SQL injection - [SAMO Forms <= 1.0.0 - Unauthenticated SQLi](https://agentprime.io/advisories/CVE-2026-80491.md) `CVE-2026-80491` · CVE record: Unknown SAMO Forms · CVSS 8.6 High · Not analysed yet · Published 12 Sept 2026 · Tags: SQL injection - [WordPress Amelia plugin <= 2.4.9 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62112.md) `CVE-2026-62112` · CVE record: Melograno Venture Studio Amelia · CVSS 7.6 High · Not analysed yet · Published 11 Sept 2026 · Tags: SQL injection - [WordPress Sky Addons for Elementor plugin <= 3.8.4 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62109.md) `CVE-2026-62109` · CVE record: wowDevs Sky Addons for Elementor · CVSS 7.6 High · Not analysed yet · Published 11 Sept 2026 · Tags: SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .