# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQLi via tzwrs_update_cell](https://agentprime.io/advisories/CVE-2026-87775.md) `CVE-2026-87775` · CVE record: Unknown Tz Weekly Radio Schedule · CVSS 8.6 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQL Injection via week](https://agentprime.io/advisories/CVE-2026-87774.md) `CVE-2026-87774` · CVE record: Unknown Tz Weekly Radio Schedule · CVSS 8.6 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [Product Question and Answer <= 1.1.0 - Unauthenticated SQL Injection via p_id and read](https://agentprime.io/advisories/CVE-2026-87771.md) `CVE-2026-87771` · CVE record: Unknown Product Question and Answer · CVSS 8.6 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [Price Drop Alert for WooCommerce <= 1.1 - Unauthenticated SQL Injection via product](https://agentprime.io/advisories/CVE-2026-87770.md) `CVE-2026-87770` · CVE record: Unknown Price Drop Alert for Woo Commerce · CVSS 8.6 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [WP Shortcut Link <= 1.2.0 - Unauthenticated SQL Injection via url](https://agentprime.io/advisories/CVE-2026-87767.md) `CVE-2026-87767` · CVE record: Unknown wp shortcut link and advertisement baner · CVSS 8.6 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [Authenticated SQL injection](https://agentprime.io/advisories/CVE-2026-18912.md) `CVE-2026-18912` · CVE record: Zohocorp DataSecurity Plus · CVSS 8.1 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php](https://agentprime.io/advisories/CVE-2026-54647.md) `CVE-2026-54647` · CVE record: cubecart v6 · CVSS 7.2 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php](https://agentprime.io/advisories/CVE-2026-54646.md) `CVE-2026-54646` · CVE record: cubecart v6 · CVSS 7.2 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution](https://agentprime.io/advisories/CVE-2026-53557.md) `CVE-2026-53557` · CVE record: dataease SQLBot · CVSS 7.7 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read](https://agentprime.io/advisories/CVE-2026-53556.md) `CVE-2026-53556` · CVE record: dataease SQLBot · CVSS 6.0 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [SigNoz 0.87.0 before 0.142.0 - SQL Injection in v5 Query Builder Field Key Names](https://agentprime.io/advisories/CVE-2026-93426.md) `CVE-2026-93426` · CVE record: SigNoz signoz · CVSS 8.4 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter](https://agentprime.io/advisories/CVE-2026-54597.md) `CVE-2026-54597` · CVE record: itflow-org itflow · CVSS 8.3 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration](https://agentprime.io/advisories/CVE-2026-54596.md) `CVE-2026-54596` · CVE record: itflow-org itflow · CVSS 8.1 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection](https://agentprime.io/advisories/GHSA-vjqc-q4mp-2rvf.md) `GHSA-vjqc-q4mp-2rvf`, `CVE-2026-79752`, `PKSA-ny8z-1rqf-8z42`, `PKSA-vxgj-bmcq-9b6x` · Packagist `cakephp/cakephp` and 1 more: affected `<4.5.12 || >=4.6.0, <4.6.5 || >=5.0.0, <5.1.9 || >=5.2.0, <5.2.14 || >=5.3.0, <5.3.7`, fixed in `4.5.12`, `4.6.5`, `5.1.9`, `5.2.14`, `5.3.7` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation](https://agentprime.io/advisories/CVE-2026-54354.md) `CVE-2026-54354` · CVE record: MapServer MapServer · CVSS 8.2 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report](https://agentprime.io/advisories/CVE-2026-54524.md) `CVE-2026-54524` · CVE record: frappe hrms · CVSS 7.1 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [Traccar: Authenticated Blind SQL Injection in DELETE /api/permissions](https://agentprime.io/advisories/CVE-2026-52851.md) `CVE-2026-52851` · CVE record: traccar traccar · CVSS 7.1 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [code-projects Matrimonial System partner_preference.php writepartnerprefs sql injection](https://agentprime.io/advisories/CVE-2026-92926.md) `CVE-2026-92926` · CVE record: code-projects Matrimonial System · CVSS 6.9 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Other injection, SQL injection - [SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builders](https://agentprime.io/advisories/CVE-2026-93292.md) `CVE-2026-93292` · CVE record: SigNoz signoz · CVSS 8.4 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [Marten's LINQ provider has SQL injection via unescaped string literals](https://agentprime.io/advisories/GHSA-rfx3-98h7-v3xp.md) `GHSA-rfx3-98h7-v3xp`, `CVE-2026-75513` · NuGet `Marten`: affected `>=7.0.0, <8.37.4 || >=9.0.0, <9.13.0`, fixed in `8.37.4`, `9.13.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66631.md) `CVE-2026-66631` · CVE record: Moreconvert Team MC Woocommerce Wishlist · CVSS 7.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66630.md) `CVE-2026-66630` · CVE record: PublishPress PublishPress Series · CVSS 7.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66628.md) `CVE-2026-66628` · CVE record: WP Lab WP-Lister Lite for eBay · CVSS 7.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [WordPress SKT Addons for Elementor plugin <= 4.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66626.md) `CVE-2026-66626` · CVE record: Sonal S Sinha SKT Addons for Elementor · CVSS 7.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [WordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66625.md) `CVE-2026-66625` · CVE record: WCVendors WC Vendors Marketplace · CVSS 7.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [WordPress WPMasterToolKit plugin <= 2.22.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66624.md) `CVE-2026-66624` · CVE record: Ludwig You WPMasterToolKit · CVSS 7.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [WordPress Newsletters plugin <= 4.18 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66619.md) `CVE-2026-66619` · CVE record: Tribulant Software Newsletters · CVSS 7.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [WordPress WP Maps plugin <= 4.9.9 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66618.md) `CVE-2026-66618` · CVE record: Flipper Code WP Maps · CVSS 7.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [WordPress Product Feed Manager plugin <= 7.12.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66580.md) `CVE-2026-66580` · CVE record: RexTheme Product Feed Manager · CVSS 8.5 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [Improper Input Validation in Snowflake CLI Versions Allow Unsanitized User-Controlled Values to be Interpolated into SQL Strings](https://agentprime.io/advisories/CVE-2026-92903.md) `CVE-2026-92903` · CVE record: Snowflake Snowflake CLI · CVSS 8.2 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter](https://agentprime.io/advisories/CVE-2026-87963.md) `CVE-2026-87963` · CVE record: Unknown Yo · CVSS 8.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists.](https://agentprime.io/advisories/CVE-2025-55787.md) `CVE-2025-55787` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [Cisco ISE REST API SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-76426.md) `CVE-2026-76426` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [Cisco Identity Services Engine SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-20300.md) `CVE-2026-20300` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 7.1 High · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [Cisco Identity Services Engine SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-76448.md) `CVE-2026-76448` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [Cisco Identity Services Engine Certificate Management SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-76451.md) `CVE-2026-76451` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [Cisco Identity Services Engine Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-20235.md) `CVE-2026-20235` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 4.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [Cisco Identity Services Engine SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-76449.md) `CVE-2026-76449` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [Cisco Identity Services Engine SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-76450.md) `CVE-2026-76450` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [Cisco ISE Profiler SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-76428.md) `CVE-2026-76428` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [Cisco ISE SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-76425.md) `CVE-2026-76425` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 7.6 High · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [Cisco Secure Firewall Management Center Software SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-20344.md) `CVE-2026-20344` · CVE record: Cisco Cisco Secure Firewall Management Center (FMC) · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [Cisco Identity Services Engine Unauthenticated SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-20247.md) `CVE-2026-20247` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [Cisco Nexus Dashboard Software Security Hardening Release September 2026 - SQL Injection](https://agentprime.io/advisories/CVE-2026-20361.md) `CVE-2026-20361` · CVE record: Cisco Cisco Nexus Dashboard · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [itsourcecode Leave Management System index.php sql injection](https://agentprime.io/advisories/CVE-2026-92526.md) `CVE-2026-92526` · CVE record: itsourcecode Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection, SQL injection - [Tanium addressed a SQL injection vulnerability in Threat Response.](https://agentprime.io/advisories/CVE-2026-87105.md) `CVE-2026-87105` · CVE record: Tanium Threat Response · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [Tanium addressed a SQL injection vulnerability in Asset.](https://agentprime.io/advisories/CVE-2026-87024.md) `CVE-2026-87024` · CVE record: Tanium Asset · CVSS 7.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [Tanium addressed a SQL injection vulnerability in Asset.](https://agentprime.io/advisories/CVE-2026-86865.md) `CVE-2026-86865` · CVE record: Tanium Asset · CVSS 7.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [SourceCodester Inventory and Monitoring System btn_functions.php add sql injection](https://agentprime.io/advisories/CVE-2026-92406.md) `CVE-2026-92406` · CVE record: SourceCodester Inventory and Monitoring System · CVSS 6.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Inventory and Monitoring System index.php sql injection](https://agentprime.io/advisories/CVE-2026-92405.md) `CVE-2026-92405` · CVE record: SourceCodester Inventory and Monitoring System · CVSS 6.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection, SQL injection - [MikroORM: SQL injection via unvalidated order direction in orderBy](https://agentprime.io/advisories/CVE-2026-84993.md) `CVE-2026-84993` · CVE record: mikro-orm mikro-orm · CVSS 6.5 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [Scada-LTS Authenticated Blind SQL Injection](https://agentprime.io/advisories/CVE-2026-84859.md) `CVE-2026-84859` · CVE record: Scada-LTS Scada-LTS · CVSS 6.5 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [code-projects Matrimonial System Regular Search search.php sql injection](https://agentprime.io/advisories/CVE-2026-92366.md) `CVE-2026-92366` · CVE record: code-projects Matrimonial System · CVSS 6.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Leave Management System index.php sql injection](https://agentprime.io/advisories/CVE-2026-92364.md) `CVE-2026-92364` · CVE record: itsourcecode Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection, SQL injection - [WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-92465.md) `CVE-2026-92465` · CVE record: Themeum WP Mega Menu · CVSS 7.6 High · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated SQLi via 'sort' Parameter](https://agentprime.io/advisories/CVE-2026-78472.md) `CVE-2026-78472` · CVE record: Unknown Ni WooCommerce Sales Report · CVSS 8.6 High · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [WP Import Export Lite < 3.9.33 - Authenticated SQLi via Import Options](https://agentprime.io/advisories/CVE-2026-76557.md) `CVE-2026-76557` · CVE record: Unknown WP Import Export Lite · CVSS 6.8 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [WP Import Export Lite < 3.9.33 - Authenticated SQLi via Export Filter Rules](https://agentprime.io/advisories/CVE-2026-76556.md) `CVE-2026-76556` · CVE record: Unknown WP Import Export Lite · CVSS 6.8 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order_by' Parameter](https://agentprime.io/advisories/CVE-2026-16588.md) `CVE-2026-16588` · CVE record: wpdirectorykit WP Directory Kit · CVSS 6.5 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: SQL injection - [gedelumbung HospitalManagement app_global_admin_model.php generate_index_pasien sql injection](https://agentprime.io/advisories/CVE-2026-92221.md) `CVE-2026-92221` · CVE record: gedelumbung HospitalManagement · CVSS 5.1 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection, SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .