# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Toptech TMS7 and TopHAT SQL Injection](https://agentprime.io/advisories/CVE-2026-68068.md) `CVE-2026-68068` · CVE record: Toptech Systems TMS7 and 1 more · CVSS 8.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: SQL injection - [Toptech TMS7 and TopHAT SQL Injection](https://agentprime.io/advisories/CVE-2026-68954.md) `CVE-2026-68954` · CVE record: Toptech Systems TMS7 and 1 more · CVSS 8.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: SQL injection - [Toptech TMS7 and TopHAT SQL Injection](https://agentprime.io/advisories/CVE-2026-63713.md) `CVE-2026-63713` · CVE record: Toptech Systems TMS7 and 1 more · CVSS 8.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: SQL injection - [Toptech TMS7 and TopHAT SQL Injection](https://agentprime.io/advisories/CVE-2026-72510.md) `CVE-2026-72510` · CVE record: Toptech Systems TMS7 and 1 more · CVSS 8.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: SQL injection - [risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection](https://agentprime.io/advisories/CVE-2026-102616.md) `CVE-2026-102616` · CVE record: risesoft-y9 WorkFlow-Engine · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Other injection, SQL injection - [Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters](https://agentprime.io/advisories/CVE-2026-102796.md) `CVE-2026-102796` · CVE record: Wikimedia Foundation Mediawiki - UserPageViewTracker Extension · CVSS 7.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: SQL injection - [Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname](https://agentprime.io/advisories/CVE-2023-54400.md) `CVE-2023-54400` · CVE record: Fumasoft Fumeng Cloud · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: SQL injection - [Seeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jsp](https://agentprime.io/advisories/CVE-2015-20122.md) `CVE-2015-20122` · CVE record: Yonyou A6 OA · CVSS 8.7 High · Not analysed yet · Published 29 Sept 2026 · Tags: SQL injection - [mahonelau kykms SqlInjectionUtil QueryGenerator.java QueryGenerator.doMultiFieldsOrder sql injection](https://agentprime.io/advisories/CVE-2026-102491.md) `CVE-2026-102491` · CVE record: mahonelau kykms · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Other injection, SQL injection - [ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter](https://agentprime.io/advisories/CVE-2026-102570.md) `CVE-2026-102570` · CVE record: MacWarrior clipbucket-v5 · CVSS 7.0 High · Not analysed yet · Published 29 Sept 2026 · Tags: SQL injection - [ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter](https://agentprime.io/advisories/CVE-2026-102569.md) `CVE-2026-102569` · CVE record: MacWarrior clipbucket-v5 · CVSS 7.0 High · Not analysed yet · Published 29 Sept 2026 · Tags: SQL injection - [Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag](https://agentprime.io/advisories/CVE-2026-86843.md) `CVE-2026-86843` · CVE record: Apache Software Foundation Apache Airflow Teradata provider · CVSS 6.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: SQL injection - [Flowring Agentflow 4.0 - SQL Injection](https://agentprime.io/advisories/CVE-2026-96429.md) `CVE-2026-96429` · CVE record: Flowring Technology Corp Agentflow 4.0 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: SQL injection - [Flowring Agentflow 4.0 - SQL Injection](https://agentprime.io/advisories/CVE-2026-96428.md) `CVE-2026-96428` · CVE record: Flowring Technology Corp Agentflow 4.0 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: SQL injection - [bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component.](https://agentprime.io/advisories/CVE-2026-79536.md) `CVE-2026-79536` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: SQL injection - [SiYuan before v3.8.4 SQL Injection via Block Query Embed](https://agentprime.io/advisories/CVE-2026-101091.md) `CVE-2026-101091` · CVE record: siyuan-note siyuan · CVSS 7.1 High · Not analysed yet · Published 28 Sept 2026 · Tags: SQL injection - [Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6](https://agentprime.io/advisories/CVE-2026-101110.md) `CVE-2026-101110` · CVE record: ordasoft.com Book Library (Free) extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: SQL injection - [Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9](https://agentprime.io/advisories/CVE-2026-100752.md) `CVE-2026-100752` · CVE record: ordasoft.com Real Estate Manager (Free) extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: SQL injection - [Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8](https://agentprime.io/advisories/CVE-2026-101108.md) `CVE-2026-101108` · CVE record: ordasoft.com Vehicle Manager (Free) extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: SQL injection - [code-projects Matrimonial System Profile Creation Endpoint create_profile processprofile_form sql injection](https://agentprime.io/advisories/CVE-2026-101105.md) `CVE-2026-101105` · CVE record: code-projects Matrimonial System · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, SQL injection - [SQLi in Iron Mountain's enVision](https://agentprime.io/advisories/CVE-2026-86595.md) `CVE-2026-86595` · CVE record: Iron Mountain Archiving Services Inc. enVision · CVSS 8.8 High · Not analysed yet · Published 28 Sept 2026 · Tags: SQL injection - [Time-based SQL Injection in Dayforce ESS Excelity](https://agentprime.io/advisories/CVE-2026-73640.md) `CVE-2026-73640` · CVE record: Dayforce ESS Excelity · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: SQL injection - [dayrui XunruiCMS Group Editing Home.php group_all_edit sql injection](https://agentprime.io/advisories/CVE-2026-101018.md) `CVE-2026-101018` · CVE record: dayrui XunruiCMS · CVSS 5.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project updateresultdetails.php sql injection](https://agentprime.io/advisories/CVE-2026-101013.md) `CVE-2026-101013` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project makeresult.php sql injection](https://agentprime.io/advisories/CVE-2026-101012.md) `CVE-2026-101012` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, SQL injection - [aaPanel BaoTa Domain domainMod.py get_domain_status sql injection](https://agentprime.io/advisories/CVE-2026-101011.md) `CVE-2026-101011` · CVE record: aaPanel BaoTa · CVSS 5.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, SQL injection - [aaPanel BaoTa data.py getData sql injection](https://agentprime.io/advisories/CVE-2026-101010.md) `CVE-2026-101010` · CVE record: aaPanel BaoTa · CVSS 5.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, SQL injection - [SPS-Suite <= 1.4.0 - Unauthenticated Time-Based SQLi via Search](https://agentprime.io/advisories/CVE-2026-93000.md) `CVE-2026-93000` · CVE record: Unknown SPS-Suite · CVSS 6.8 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: SQL injection - [Post Voting System <= 1.0 - Subscriber+ SQLi via 'row' Parameter](https://agentprime.io/advisories/CVE-2026-89303.md) `CVE-2026-89303` · CVE record: Unknown Post Voting System · CVSS 6.4 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: SQL injection - [DevaslanPHP project-management Timesheet Dashboard MonthlyReport.php whereRaw sql injection](https://agentprime.io/advisories/CVE-2026-100899.md) `CVE-2026-100899` · CVE record: DevaslanPHP project-management · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, SQL injection - [DevaslanPHP project-management Timesheet Dashboard ActivitiesReport.php whereRaw sql injection](https://agentprime.io/advisories/CVE-2026-100898.md) `CVE-2026-100898` · CVE record: DevaslanPHP project-management · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection](https://agentprime.io/advisories/CVE-2026-100894.md) `CVE-2026-100894` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, SQL injection - [amirsanni Mini-Inventory-and-Sales-Management-System Database Query Builder DB_query_builder.php order_by sql injection](https://agentprime.io/advisories/CVE-2026-100887.md) `CVE-2026-100887` · CVE record: amirsanni Mini-Inventory-and-Sales-Management-System · CVSS 5.3 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php sql injection](https://agentprime.io/advisories/CVE-2026-100875.md) `CVE-2026-100875` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project addnewstudent.php sql injection](https://agentprime.io/advisories/CVE-2026-100874.md) `CVE-2026-100874` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Other injection, SQL injection - [AzuraCast before 0.23.8 DQL Injection via sortOrder](https://agentprime.io/advisories/CVE-2026-100847.md) `CVE-2026-100847` · CVE record: AzuraCast AzuraCast · CVSS 8.7 High · Not analysed yet · Published 27 Sept 2026 · Tags: SQL injection - [mathurvishal CloudClassroom-PHP-Project viewresult.php sql injection](https://agentprime.io/advisories/CVE-2026-100739.md) `CVE-2026-100739` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Other injection, SQL injection - [Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29](https://agentprime.io/advisories/CVE-2026-97162.md) `CVE-2026-97162` · CVE record: lomart.fr UP plugin for Joomla · CVSS 8.3 High · Not analysed yet · Published 26 Sept 2026 · Tags: SQL injection - [Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0](https://agentprime.io/advisories/CVE-2026-94131.md) `CVE-2026-94131` · CVE record: acymailing.com AcyMailing extension for Joomla · CVSS 8.3 High · Not analysed yet · Published 26 Sept 2026 · Tags: SQL injection - [Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3](https://agentprime.io/advisories/CVE-2026-94130.md) `CVE-2026-94130` · CVE record: joomlaboat.com YouTube Gallery extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: SQL injection - [Budibase before 3.45.0 SQL Injection via column-rename DDL](https://agentprime.io/advisories/CVE-2026-100683.md) `CVE-2026-100683` · CVE record: budibase server · CVSS 8.9 High · Not analysed yet · Published 26 Sept 2026 · Tags: SQL injection - [SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath](https://agentprime.io/advisories/CVE-2026-100644.md) `CVE-2026-100644` · CVE record: siyuan-note siyuan · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: SQL injection - [mathurvishal CloudClassroom-PHP-Project mydetailsfaculty.php sql injection](https://agentprime.io/advisories/CVE-2026-100315.md) `CVE-2026-100315` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project updatedetailsfromstudent.php sql injection](https://agentprime.io/advisories/CVE-2026-100314.md) `CVE-2026-100314` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection](https://agentprime.io/advisories/CVE-2026-100312.md) `CVE-2026-100312` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Other injection, SQL injection - [WP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter](https://agentprime.io/advisories/CVE-2026-84097.md) `CVE-2026-84097` · CVE record: Unknown wp-review-slider-pro · CVSS 6.5 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: SQL injection - [Bluff Post <= 1.1.1 - Unauthenticated SQLi via 'table_name' and 'column_name' Parameters](https://agentprime.io/advisories/CVE-2026-89237.md) `CVE-2026-89237` · CVE record: Unknown Bluff Post · CVSS 6.8 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: SQL injection - [GLPI: SQL injection in history tab](https://agentprime.io/advisories/CVE-2026-53629.md) `CVE-2026-53629` · CVE record: glpi-project glpi · CVSS 7.1 High · Not analysed yet · Published 25 Sept 2026 · Tags: SQL injection - [mathurvishal CloudClassroom-PHP-Project managevideos2.php sql injection](https://agentprime.io/advisories/CVE-2026-97886.md) `CVE-2026-97886` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project updatefaculty.php sql injection](https://agentprime.io/advisories/CVE-2026-97885.md) `CVE-2026-97885` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project Student Update Functionality updatestudent.php sql injection](https://agentprime.io/advisories/CVE-2026-97884.md) `CVE-2026-97884` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project updatequery.php sql injection](https://agentprime.io/advisories/CVE-2026-97883.md) `CVE-2026-97883` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection, SQL injection - [mathurvishal CloudClassroom-PHP-Project Faculty Authentication loginlinkfaculty.php sql injection](https://agentprime.io/advisories/CVE-2026-97882.md) `CVE-2026-97882` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection, SQL injection - [Piwigo: Second-Order SQL Injection](https://agentprime.io/advisories/CVE-2026-42324.md) `CVE-2026-42324` · CVE record: Piwigo Piwigo · CVSS 7.2 High · Not analysed yet · Published 25 Sept 2026 · Tags: SQL injection - [Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+)](https://agentprime.io/advisories/CVE-2026-44642.md) `CVE-2026-44642` · CVE record: Piwigo Piwigo · CVSS 8.1 High · Not analysed yet · Published 25 Sept 2026 · Tags: SQL injection - [Piwigo: Unauthenticated SQL injection in \`pwg.images.filteredSearch.create\`](https://agentprime.io/advisories/CVE-2026-62262.md) `CVE-2026-62262` · CVE record: Piwigo Piwigo · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: SQL injection - [Piwigo: SQL Injection in Batch Manager](https://agentprime.io/advisories/CVE-2026-42323.md) `CVE-2026-42323` · CVE record: Piwigo Piwigo · CVSS 7.2 High · Not analysed yet · Published 25 Sept 2026 · Tags: SQL injection - [InvoicePlane permits DDL injection through tax_rate_decimal_places](https://agentprime.io/advisories/CVE-2026-33639.md) `CVE-2026-33639` · CVE record: InvoicePlane InvoicePlane · CVSS 7.2 High · Not analysed yet · Published 25 Sept 2026 · Tags: SQL injection - [InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module](https://agentprime.io/advisories/CVE-2026-54790.md) `CVE-2026-54790` · CVE record: InvoicePlane InvoicePlane · CVSS 6.0 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: SQL injection - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-84893.md) `CVE-2026-84893` · CVE record: IBM Guardium Data Protection · CVSS 7.6 High · Not analysed yet · Published 25 Sept 2026 · Tags: SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .