# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [drogonframework drogon ORM Criteria.cc makeCriteria sql injection](https://agentprime.io/advisories/CVE-2026-94144.md) `CVE-2026-94144` · CVE record: drogonframework drogon · CVSS 6.9 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Other injection, SQL injection - [drogonframework drogon ORM Mapper Mapper.h orderBy sql injection](https://agentprime.io/advisories/CVE-2026-94143.md) `CVE-2026-94143` · CVE record: drogonframework drogon · CVSS 6.9 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Other injection, SQL injection - [QCMS Content Detail Controllers.php self_Tmp sql injection](https://agentprime.io/advisories/CVE-2026-94110.md) `CVE-2026-94110` · CVE record: QCMS · CVSS 6.9 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Other injection, SQL injection - [Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint (POST /user/authenticate).](https://agentprime.io/advisories/CVE-2026-88756.md) `CVE-2026-88756` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: SQL injection - [A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements.](https://agentprime.io/advisories/CVE-2026-88402.md) `CVE-2026-88402` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: SQL injection - [Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7](https://agentprime.io/advisories/CVE-2026-88854.md) `CVE-2026-88854` · CVE record: OrdaSoft.com OrdaSoft Joomla Gallery free extension for Joomla and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Sept 2026 · Tags: SQL injection - [Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7](https://agentprime.io/advisories/CVE-2026-88855.md) `CVE-2026-88855` · CVE record: OrdaSoft.com OrdaSoft Joomla Gallery free extension for Joomla and 1 more · CVSS 8.6 High · Not analysed yet · Published 20 Sept 2026 · Tags: SQL injection - [AdithyaYelloju Restaurant Management System add_table.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-94042.md) `CVE-2026-94042` · CVE record: AdithyaYelloju Restaurant Management System · CVSS 5.3 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [AdithyaYelloju Restaurant-Management-System add_menu.php sql injection](https://agentprime.io/advisories/CVE-2026-94041.md) `CVE-2026-94041` · CVE record: AdithyaYelloju Restaurant-Management-System · CVSS 5.3 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Leave Management System index.php sql injection](https://agentprime.io/advisories/CVE-2026-94032.md) `CVE-2026-94032` · CVE record: itsourcecode Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Drug Recommendation System edit_user.php sql injection](https://agentprime.io/advisories/CVE-2026-94015.md) `CVE-2026-94015` · CVE record: SourceCodester Drug Recommendation System · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Drug Recommendation System edit_symptom.php sql injection](https://agentprime.io/advisories/CVE-2026-93997.md) `CVE-2026-93997` · CVE record: SourceCodester Drug Recommendation System · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [code-projects Internship Management System Admin Login Form login.php sql injection](https://agentprime.io/advisories/CVE-2026-93980.md) `CVE-2026-93980` · CVE record: code-projects Internship Management System · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [code-projects Internship Management System login.php sql injection](https://agentprime.io/advisories/CVE-2026-93979.md) `CVE-2026-93979` · CVE record: code-projects Internship Management System · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [code-projects Internship Management System login.php sql injection](https://agentprime.io/advisories/CVE-2026-93978.md) `CVE-2026-93978` · CVE record: code-projects Internship Management System · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Reviewer Management System btn_functions.php remove sql injection](https://agentprime.io/advisories/CVE-2026-93974.md) `CVE-2026-93974` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Reviewer Management System btn_functions.php remove sql injection](https://agentprime.io/advisories/CVE-2026-93973.md) `CVE-2026-93973` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Reviewer Management System btn_functions.php sql injection](https://agentprime.io/advisories/CVE-2026-93972.md) `CVE-2026-93972` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [itsourcecode Leave Management System controller.php sql injection](https://agentprime.io/advisories/CVE-2026-93963.md) `CVE-2026-93963` · CVE record: itsourcecode Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Reviewer Management System btn_functions.php sql injection](https://agentprime.io/advisories/CVE-2026-93959.md) `CVE-2026-93959` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, SQL injection - [OpenPanel through 2.3.0 SQL Injection via ClickHouse Property Key Filter](https://agentprime.io/advisories/CVE-2026-93983.md) `CVE-2026-93983` · CVE record: Openpanel-dev openpanel · CVSS 5.3 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: SQL injection - [Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter](https://agentprime.io/advisories/CVE-2026-9855.md) `CVE-2026-9855` · CVE record: hiroaki-miyashita Custom Field Template · CVSS 6.5 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: SQL injection - [GoPay for WooCommerce <= 1.0.36 - Authenticated (Shop Manager+) SQL Injection via 'log_table_filter' Parameter](https://agentprime.io/advisories/CVE-2026-75959.md) `CVE-2026-75959` · CVE record: gopayplugins GoPay for WooCommerce · CVSS 4.9 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: SQL injection - [Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parameter](https://agentprime.io/advisories/CVE-2026-13200.md) `CVE-2026-13200` · CVE record: mischiefmarmot Create · CVSS 6.5 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: SQL injection - [WP Optimizer <= 2.5.0 - Authenticated (Administrator+) SQL Injection via 's' Parameter](https://agentprime.io/advisories/CVE-2026-6295.md) `CVE-2026-6295` · CVE record: sh1zen WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals · CVSS 4.9 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: SQL injection - [Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order_by' Parameter](https://agentprime.io/advisories/CVE-2026-13191.md) `CVE-2026-13191` · CVE record: mischiefmarmot Create · CVSS 6.5 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: SQL injection - [VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi](https://agentprime.io/advisories/CVE-2026-88926.md) `CVE-2026-88926` · CVE record: Unknown VikRentItems Flexible Rental Management System · CVSS 8.6 High · Not analysed yet · Published 19 Sept 2026 · Tags: SQL injection - [CordysCRM: Authenticated SQL injection via \`sort.name\` on \`POST /account-pool/page\`](https://agentprime.io/advisories/CVE-2026-76899.md) `CVE-2026-76899` · CVE record: 1Panel-dev CordysCRM · CVSS 5.7 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection, CWE-1284 - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-84239.md) `CVE-2026-84239` · CVE record: IBM Guardium Data Protection · CVSS 7.6 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-84105.md) `CVE-2026-84105` · CVE record: IBM Guardium Data Protection · CVSS 7.7 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [CordysCRM: Customer Public Pool Sorting Field SQL Injection](https://agentprime.io/advisories/CVE-2026-52745.md) `CVE-2026-52745` · CVE record: 1Panel-dev CordysCRM · CVSS 5.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-84082.md) `CVE-2026-84082` · CVE record: IBM Guardium Data Protection · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [pg_partman privilege escalation via SQL injection in when using pg_jobmon and encountering exception](https://agentprime.io/advisories/CVE-2026-61819.md) `CVE-2026-61819` · CVE record: pgpartman pg_partman · CVSS 8.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [pg_partman privilege escalation via SQL injection when inheriting template properties](https://agentprime.io/advisories/CVE-2026-61820.md) `CVE-2026-61820` · CVE record: pgpartman pg_partman · CVSS 8.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [pg_partman privilege escalation via SQL injection in several functions via time decoder](https://agentprime.io/advisories/CVE-2026-61817.md) `CVE-2026-61817` · CVE record: pgpartman pg_partman · CVSS 8.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [pg_partman SQL injection in undo partition time encoder](https://agentprime.io/advisories/CVE-2026-61818.md) `CVE-2026-61818` · CVE record: pgpartman pg_partman · CVSS 8.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-84073.md) `CVE-2026-84073` · CVE record: IBM Guardium Data Protection · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [pg_partman has privilege escalation through SQL injection in create_partition_time()](https://agentprime.io/advisories/CVE-2026-61781.md) `CVE-2026-61781` · CVE record: pgpartman pg_partman · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection, Privilege escalation - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-84064.md) `CVE-2026-84064` · CVE record: IBM Guardium Data Protection · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-81933.md) `CVE-2026-81933` · CVE record: IBM Guardium Data Protection · CVSS 8.8 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-81656.md) `CVE-2026-81656` · CVE record: IBM Guardium Data Protection · CVSS 8.8 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-81626.md) `CVE-2026-81626` · CVE record: IBM Guardium Data Protection · CVSS 8.6 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-80441.md) `CVE-2026-80441` · CVE record: IBM Guardium Data Protection · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [The IBM Platform RTM is affected by an SQL injection vulnerability](https://agentprime.io/advisories/CVE-2026-17619.md) `CVE-2026-17619` · CVE record: IBM spectrum-lsf : IBM Platform RTM · CVSS 8.6 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [Chanjet CRM SQL Injection via get_usedspace.php](https://agentprime.io/advisories/CVE-2021-48008.md) `CVE-2021-48008` · CVE record: Chanjet Information Technology Co., Ltd. CRM · CVSS 8.7 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [Weaver E-cology SQL Injection via SyncUserInfo.jsp](https://agentprime.io/advisories/CVE-2019-25776.md) `CVE-2019-25776` · CVE record: Weaver Network Co., Ltd. E-cology · CVSS 8.7 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [Hongjing e-HR < 8.2 SQL Injection via /servlet/codesettree](https://agentprime.io/advisories/CVE-2023-54399.md) `CVE-2023-54399` · CVE record: Hongjing e-HR · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [ClipBucket < 5.5.3-#182 Blind SQL Injection via Private Message Deletion Endpoint](https://agentprime.io/advisories/CVE-2026-77928.md) `CVE-2026-77928` · CVE record: MacWarrior clipbucket-v5 · CVSS 7.1 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [ClipBucket < 5.5.3-#182 Blind SQL Injection via Photo Deletion Endpoint](https://agentprime.io/advisories/CVE-2026-77927.md) `CVE-2026-77927` · CVE record: MacWarrior clipbucket-v5 · CVSS 7.1 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go](https://agentprime.io/advisories/CVE-2026-93591.md) `CVE-2026-93591` · CVE record: siyuan-note siyuan · CVSS 7.2 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [SQL injection in Synology DiskStation Manager (DSM)](https://agentprime.io/advisories/CVE-2026-4036.md) `CVE-2026-4036` · CVE record: Synology DiskStation Manager (DSM) · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [SQL injection in Synology DiskStation Manager (DSM)](https://agentprime.io/advisories/CVE-2026-13683.md) `CVE-2026-13683` · CVE record: Synology DiskStation Manager (DSM) · CVSS 2.7 Low · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [HCL BigFix Service Management is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-67100.md) `CVE-2026-67100` · CVE record: HCL Software HCL BigFix Service Management · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection, Information disclosure - [Location Manager <= 2.3.38 - Unauthenticated SQL Injection via 'latitude' and 'longitude' REST API Parameters](https://agentprime.io/advisories/CVE-2026-85705.md) `CVE-2026-85705` · CVE record: AyeCode Ltd Location Manager · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [WP Multi Store Locator Pro <= 4.5.1 - Unauthenticated SQL Injection via 'store_locator_search_radius' Parameter](https://agentprime.io/advisories/CVE-2026-15275.md) `CVE-2026-15275` · CVE record: wpexpertsio WP Multi Store Locator Pro · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [Photo Gallery by 10Web <= 1.8.44 - Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-85652.md) `CVE-2026-85652` · CVE record: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter](https://agentprime.io/advisories/CVE-2026-75961.md) `CVE-2026-75961` · CVE record: webaways NEX-Forms – Ultimate Forms Plugin for WordPress · CVSS 4.9 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [WP Inventory Manager <= 2.5.1 - Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-17607.md) `CVE-2026-17607` · CVE record: chuck1982 WP Inventory Manager · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter](https://agentprime.io/advisories/CVE-2026-18442.md) `CVE-2026-18442` · CVE record: wclovers WCFM Marketplace – Multivendor Marketplace for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [InfiniteWP Client <= 1.13.9 - Authenticated (Admin+) SQL Injection via 'iwp_get_comments\_\*' Array Key](https://agentprime.io/advisories/CVE-2026-17576.md) `CVE-2026-17576` · CVE record: revmakx InfiniteWP Client · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .