# SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter](https://agentprime.io/advisories/CVE-2026-93899.md)
  `CVE-2026-93899` · CVE record: wordplus Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots · CVSS 6.5 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: SQL injection
- [phpMyFAQ has SQL Injection in \`StopWords::add()\` — Unescaped Stop Word Insertion](https://agentprime.io/advisories/GHSA-rw77-vq4g-x3hp.md)
  `GHSA-rw77-vq4g-x3hp`, `CVE-2026-56738`, `PKSA-5kfv-yxk9-ft5p`, `PKSA-mq9q-wz1h-jkfd` · Packagist `phpmyfaq/phpmyfaq` and 1 more: affected `<4.1.6`, fixed in `4.1.6` · CVSS 8.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: SQL injection
- [Unauthenticated SQL Injection in ServiceNow AI Platform](https://agentprime.io/advisories/CVE-2026-13016.md)
  `CVE-2026-13016` · CVE record: ServiceNow ServiceNow AI Platform · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: SQL injection
- [YunaiV/zhijiantianya ruoyi-vue-pro GoView Data Endpoint GoViewDataServiceImpl.java GoViewDataServiceImpl.getDataBySQL sql injection](https://agentprime.io/advisories/CVE-2026-97321.md)
  `CVE-2026-97321` · CVE record: YunaiV ruoyi-vue-pro and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Other injection, SQL injection
- [IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-77874.md)
  `CVE-2026-77874` · CVE record: IBM Enterprise Build of Quarkus · CVSS 8.6 High · Not analysed yet · Published 24 Sept 2026 · Tags: SQL injection
- [SQL Injection in DIAEnergie](https://agentprime.io/advisories/CVE-2026-78311.md)
  `CVE-2026-78311` · CVE record: Deltaww DIAEnergie · CVSS 8.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: SQL injection
- [SQL Injection in DIAEnergie](https://agentprime.io/advisories/CVE-2026-78309.md)
  `CVE-2026-78309` · CVE record: Deltaww DIAEnergie · CVSS 8.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: SQL injection
- [java110 MicroCommunity fallBack API Endpoint BusinessApi.java QueryServiceSMOImpl.fallBack sql injection](https://agentprime.io/advisories/CVE-2026-96803.md)
  `CVE-2026-96803` · CVE record: java110 MicroCommunity · CVSS 6.9 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Other injection, SQL injection
- [Forma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injection](https://agentprime.io/advisories/CVE-2026-96777.md)
  `CVE-2026-96777` · CVE record: Forma LMS · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Other injection, SQL injection
- [pmTicket Project-Management-Software add_project.php setSync sql injection](https://agentprime.io/advisories/CVE-2026-96751.md)
  `CVE-2026-96751` · CVE record: pmTicket Project-Management-Software · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection
- [SoftNews Media Group DataLife Engine Search search.php strip_data sql injection](https://agentprime.io/advisories/CVE-2026-96604.md)
  `CVE-2026-96604` · CVE record: SoftNews Media Group DataLife Engine · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection
- [ReactPress has SQL injection via dynamic column names in TypeORM query builders](https://agentprime.io/advisories/GHSA-wmw4-mw6x-6vfm.md)
  `GHSA-wmw4-mw6x-6vfm`, `CVE-2026-61685` · npm `@fecommunity/reactpress`: affected `<3.7.0`, fixed in `3.7.0` · CVSS 7.5 High · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [Abdurrab5 online-makeup-store Customer Login customerSignin.php sql injection](https://agentprime.io/advisories/CVE-2026-96602.md)
  `CVE-2026-96602` · CVE record: Abdurrab5 online-makeup-store · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection
- [Abdurrab5 online-makeup-store Admin Login index.php sql injection](https://agentprime.io/advisories/CVE-2026-96601.md)
  `CVE-2026-96601` · CVE record: Abdurrab5 online-makeup-store · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection
- [WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96826.md)
  `CVE-2026-96826` · CVE record: Shazzad Hossain Khan W4 Post List · CVSS 7.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0](https://agentprime.io/advisories/CVE-2026-90901.md)
  `CVE-2026-90901` · CVE record: joomshaper.com Easy Store extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0](https://agentprime.io/advisories/CVE-2026-90902.md)
  `CVE-2026-90902` · CVE record: joomshaper.com Easy Store extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [Sulu: JCR-SQL2 injection via \`categories\` query parameter (unauthenticated)](https://agentprime.io/advisories/GHSA-jg26-q8hg-3pq4.md)
  `GHSA-jg26-q8hg-3pq4`, `CVE-2026-92692`, `PKSA-mg6n-7v6r-wbcq` · Packagist `sulu/sulu`: affected `<2.6.25 || >=3.0.0, <3.0.8`, fixed in `2.6.25`, `3.0.8` · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [WordPress Product Filter by WBW plugin <= 3.1.7 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-95601.md)
  `CVE-2026-95601` · CVE record: WBW Plugins Product Filter by WBW · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [WordPress Ultimeter plugin <= 3.0.8 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-95593.md)
  `CVE-2026-95593` · CVE record: Ben Roberts Ultimeter · CVSS 7.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [WordPress Tainacan plugin <= 1.2.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-95590.md)
  `CVE-2026-95590` · CVE record: tainacan Tainacan · CVSS 7.1 High · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-95522.md)
  `CVE-2026-95522` · CVE record: Syed Balkhi Easy Digital Downloads · CVSS 7.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94174.md)
  `CVE-2026-94174` · CVE record: WebFactory Email Log · CVSS 7.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [WordPress WP EasyCart plugin <= 5.9.4 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94124.md)
  `CVE-2026-94124` · CVE record: levelfourdevelopment WP EasyCart · CVSS 8.5 High · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [WordPress Mollie Forms plugin <= 2.11.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93773.md)
  `CVE-2026-93773` · CVE record: Nick van Wobbie Mollie Forms · CVSS 8.5 High · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [WordPress Live Copy Paste for Elementor plugin <= 1.5.10 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93527.md)
  `CVE-2026-93527` · CVE record: bdthemes Live Copy Paste for Elementor · CVSS 8.5 High · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [Neethuharii CafeManagement Login CafePortalLogin.php sql injection](https://agentprime.io/advisories/CVE-2026-96514.md)
  `CVE-2026-96514` · CVE record: Neethuharii CafeManagement · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection
- [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-18180.md)
  `CVE-2026-18180` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [Photoview through 2.4.0 SQL Injection via album download route](https://agentprime.io/advisories/CVE-2026-96673.md)
  `CVE-2026-96673` · CVE record: Photoview Photoview · CVSS 8.7 High · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks](https://agentprime.io/advisories/CVE-2026-96600.md)
  `CVE-2026-96600` · CVE record: isotope isotope-core · CVSS 7.0 High · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [Broken Authentication vulnerability](https://agentprime.io/advisories/CVE-2026-86677.md)
  `CVE-2026-86677` · CVE record: Zohocorp ManageEngine Applications Manager · CVSS 8.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-14913.md)
  `CVE-2026-14913` · CVE record: Zohocorp ManageEngine OpManager and 1 more · CVSS 8.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter](https://agentprime.io/advisories/CVE-2026-93368.md)
  `CVE-2026-93368` · CVE record: travispluse Rename wp-login.php to anything you want · CVSS 7.5 High · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)](https://agentprime.io/advisories/CVE-2026-91024.md)
  `CVE-2026-91024` · CVE record: Unknown Booking Manager · CVSS 6.8 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [JetFormBuilder Stripe Gateway < 1.1.0 - Unauthenticated Blind SQLi via Payment Token](https://agentprime.io/advisories/CVE-2022-4997.md)
  `CVE-2022-4997` · CVE record: Unknown jet-form-builder-stripe-gateway · CVSS 8.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [iFlytek astron-agent getBotList API endpoint ChatBotMarketMapper.xml sql injection](https://agentprime.io/advisories/CVE-2026-95929.md)
  `CVE-2026-95929` · CVE record: iFlytek astron-agent · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection
- [SourceCodester Online Reviewer Management System exam-delete.php sql injection](https://agentprime.io/advisories/CVE-2026-95927.md)
  `CVE-2026-95927` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection
- [SourceCodester Online Reviewer Management System btn_functions.php update sql injection](https://agentprime.io/advisories/CVE-2026-95926.md)
  `CVE-2026-95926` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection
- [SourceCodester Online Reviewer Management System btn_functions.php update sql injection](https://agentprime.io/advisories/CVE-2026-95925.md)
  `CVE-2026-95925` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection
- [SourceCodester Online Reviewer Management System btn_functions.php add sql injection](https://agentprime.io/advisories/CVE-2026-95924.md)
  `CVE-2026-95924` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection
- [ClipBucket v5 before 5.5.3-#182 SQL Injection via search_result.php](https://agentprime.io/advisories/CVE-2026-96272.md)
  `CVE-2026-96272` · CVE record: MacWarrior clipbucket-v5 · CVSS 8.7 High · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [AdithyaYelloju Restaurant-Management-System Search Form display_menu.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-95868.md)
  `CVE-2026-95868` · CVE record: AdithyaYelloju Restaurant-Management-System · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, SQL injection
- [SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests](https://agentprime.io/advisories/CVE-2025-63564.md)
  `CVE-2025-63564` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [itsourcecode Leave Management System index.php sql injection](https://agentprime.io/advisories/CVE-2026-95833.md)
  `CVE-2026-95833` · CVE record: itsourcecode Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Other injection, SQL injection
- [TDuckCloud tduck-platform Pagination Inner Interceptor MybatisPlusConfig.java PaginationInnerInterceptor.concatOrderBy sql injection](https://agentprime.io/advisories/CVE-2026-95829.md)
  `CVE-2026-95829` · CVE record: TDuckCloud tduck-platform · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Other injection, SQL injection
- [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-18137.md)
  `CVE-2026-18137` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 8.1 High · Not analysed yet · Published 22 Sept 2026 · Tags: SQL injection
- [anirbandutta9 College-Notes-Gallery login.php sql injection](https://agentprime.io/advisories/CVE-2026-95819.md)
  `CVE-2026-95819` · CVE record: anirbandutta9 College-Notes-Gallery · CVSS 6.9 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Other injection, SQL injection
- [Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-75682.md)
  `CVE-2026-75682` · CVE record: Adobe Adobe Connect and 1 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: SQL injection
- [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-82009.md)
  `CVE-2026-82009` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: SQL injection
- [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-82011.md)
  `CVE-2026-82011` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: SQL injection
- [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-82010.md)
  `CVE-2026-82010` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: SQL injection
- [SQL injection in NVIDIA Infrastructure Controller](https://agentprime.io/advisories/CVE-2026-65128.md)
  `CVE-2026-65128` · CVE record: NVIDIA Infrastructure Controller · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: SQL injection
- [SQLi in Karel Electronics' KarelIPS](https://agentprime.io/advisories/CVE-2026-12718.md)
  `CVE-2026-12718` · CVE record: Karel Electronic Industry and Trade Inc. KarelIPS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: SQL injection
- [WordPress HashBar – WordPress Notification Bar plugin <= 2.0.3 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94117.md)
  `CVE-2026-94117` · CVE record: DevItems HashBar – WordPress Notification Bar · CVSS 7.6 High · Not analysed yet · Published 22 Sept 2026 · Tags: SQL injection
- [Yonyou U8cloud OpenAPI so.saleorder.sendaudit sql injection](https://agentprime.io/advisories/CVE-2026-94492.md)
  `CVE-2026-94492` · CVE record: Yonyou U8cloud · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Other injection, SQL injection
- [Yonyou KSOA search_list.jsp sql injection](https://agentprime.io/advisories/CVE-2026-94491.md)
  `CVE-2026-94491` · CVE record: Yonyou KSOA · CVSS 6.9 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Other injection, SQL injection
- [MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature.](https://agentprime.io/advisories/CVE-2026-88416.md)
  `CVE-2026-88416` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: SQL injection
- [MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do).](https://agentprime.io/advisories/CVE-2026-88414.md)
  `CVE-2026-88414` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: SQL injection
- [Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution](https://agentprime.io/advisories/CVE-2026-65980.md)
  `CVE-2026-65980` · CVE record: chartbrew chartbrew · CVSS 7.9 High · Not analysed yet · Published 21 Sept 2026 · Tags: SQL injection
- [Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool](https://agentprime.io/advisories/CVE-2026-61852.md)
  `CVE-2026-61852` · CVE record: chartbrew chartbrew · CVSS 5.8 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: SQL injection

Newest: <https://agentprime.io/advisories/tag/sql-injection.md>
Older: <https://agentprime.io/advisories/tag/sql-injection.md?cursor=WyIyMDI2LTA5LTIxVDIxOjM5OjUyLjU3OTAwMFoiLCJDVkUtMjAyNi02MTg1MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=sql-injection&cursor=WyIyMDI2LTA5LTI1VDEzOjU4OjMwLjM4MjAwMFoiLCJDVkUtMjAyNi04NDg5MyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/sql-injection/?cursor=WyIyMDI2LTA5LTI1VDEzOjU4OjMwLjM4MjAwMFoiLCJDVkUtMjAyNi04NDg5MyJd>. Everything for agents: <https://agentprime.io/llms.txt>.