# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-103352.md) `CVE-2026-103352` · CVE record: WP BASE WP BASE Booking · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: SQL injection - [onetwothreeneth HospitalManagementSystem transaction_details.php sql injection](https://agentprime.io/advisories/CVE-2026-105385.md) `CVE-2026-105385` · CVE record: onetwothreeneth HospitalManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [UNION HospitalManagementSystem patient_info.php sql injection](https://agentprime.io/advisories/CVE-2026-105384.md) `CVE-2026-105384` · CVE record: UNION HospitalManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [onetwothreeneth HospitalManagementSystem controller.php sql injection](https://agentprime.io/advisories/CVE-2026-105383.md) `CVE-2026-105383` · CVE record: onetwothreeneth HospitalManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16](https://agentprime.io/advisories/CVE-2026-102428.md) `CVE-2026-102428` · CVE record: ordasoft.com OrdaSoft Joomla CCK · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: SQL injection - [feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql injection](https://agentprime.io/advisories/CVE-2026-105287.md) `CVE-2026-105287` · CVE record: feelec-yishu feelcrm-os · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [WordPress Sirv plugin <= 8.2.5 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-104389.md) `CVE-2026-104389` · CVE record: Sirv Sirv · CVSS 8.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: SQL injection - [WordPress Groundhogg plugin <= 4.8.3 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-104408.md) `CVE-2026-104408` · CVE record: Groundhogg Groundhogg · CVSS 7.6 High · Not analysed yet · Published 5 Oct 2026 · Tags: SQL injection - [itsourcecode Online Admission System schoolyear.php sql injection](https://agentprime.io/advisories/CVE-2026-105254.md) `CVE-2026-105254` · CVE record: itsourcecode Online Admission System · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Admission System Project login1.php sql injection](https://agentprime.io/advisories/CVE-2026-105253.md) `CVE-2026-105253` · CVE record: itsourcecode Online Admission System Project · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Reviewer Management System btn_functions.php course sql injection](https://agentprime.io/advisories/CVE-2026-105247.md) `CVE-2026-105247` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Reviewer Management System btn_functions.php update sql injection](https://agentprime.io/advisories/CVE-2026-105246.md) `CVE-2026-105246` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [kishor-23 food-waste-management-system Registration deliverysignup.php sql injection](https://agentprime.io/advisories/CVE-2026-105232.md) `CVE-2026-105232` · CVE record: kishor-23 food-waste-management-system · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [kishor-23 food-waste-management-system Admin Registration signup.php sql injection](https://agentprime.io/advisories/CVE-2026-105231.md) `CVE-2026-105231` · CVE record: kishor-23 food-waste-management-system · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [kishor-23 food-waste-management-system deliverymyord.php sql injection](https://agentprime.io/advisories/CVE-2026-105230.md) `CVE-2026-105230` · CVE record: kishor-23 food-waste-management-system · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [kishor-23 food-waste-management-system User Registration Endpoint signup.php sql injection](https://agentprime.io/advisories/CVE-2026-105229.md) `CVE-2026-105229` · CVE record: kishor-23 food-waste-management-system · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Admission System key.php sql injection](https://agentprime.io/advisories/CVE-2026-105187.md) `CVE-2026-105187` · CVE record: itsourcecode Online Admission System · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Admission System new.php sql injection](https://agentprime.io/advisories/CVE-2026-105186.md) `CVE-2026-105186` · CVE record: itsourcecode Online Admission System · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Admission System examinee.php sql injection](https://agentprime.io/advisories/CVE-2026-105185.md) `CVE-2026-105185` · CVE record: itsourcecode Online Admission System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Admission System creteria.php sql injection](https://agentprime.io/advisories/CVE-2026-105184.md) `CVE-2026-105184` · CVE record: itsourcecode Online Admission System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Admission System confirm.php sql injection](https://agentprime.io/advisories/CVE-2026-105183.md) `CVE-2026-105183` · CVE record: itsourcecode Online Admission System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Reviewer Management System btn_functions.php update sql injection](https://agentprime.io/advisories/CVE-2026-105182.md) `CVE-2026-105182` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Admission System register1.php sql injection](https://agentprime.io/advisories/CVE-2026-105181.md) `CVE-2026-105181` · CVE record: itsourcecode Online Admission System · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Drug Recommendation System Symptom Creation add_symptom.php mysqli_real_escape_string sql injection](https://agentprime.io/advisories/CVE-2026-105178.md) `CVE-2026-105178` · CVE record: SourceCodester Drug Recommendation System · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Drug Recommendation System Drug Creation add_drug.php sql injection](https://agentprime.io/advisories/CVE-2026-105177.md) `CVE-2026-105177` · CVE record: SourceCodester Drug Recommendation System · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Drug Recommendation System edit_class.php sql injection](https://agentprime.io/advisories/CVE-2026-105176.md) `CVE-2026-105176` · CVE record: SourceCodester Drug Recommendation System · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Drug Recommendation System Student Registration add_student.php sql injection](https://agentprime.io/advisories/CVE-2026-105175.md) `CVE-2026-105175` · CVE record: SourceCodester Drug Recommendation System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Admission System login1.php sql injection](https://agentprime.io/advisories/CVE-2026-105172.md) `CVE-2026-105172` · CVE record: itsourcecode Online Admission System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection - [FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter().](https://agentprime.io/advisories/CVE-2026-88424.md) `CVE-2026-88424` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: SQL injection - [ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter.](https://agentprime.io/advisories/CVE-2026-88397.md) `CVE-2026-88397` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: SQL injection - [GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.](https://agentprime.io/advisories/CVE-2026-88395.md) `CVE-2026-88395` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: SQL injection - [kishor-23 food-waste-management-system Take Order delivery.php sql injection](https://agentprime.io/advisories/CVE-2026-105169.md) `CVE-2026-105169` · CVE record: kishor-23 food-waste-management-system · CVSS 6.9 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Other injection, SQL injection - [kishor-23 food-waste-management-system Order Assignment Block admin.php sql injection](https://agentprime.io/advisories/CVE-2026-105168.md) `CVE-2026-105168` · CVE record: kishor-23 food-waste-management-system · CVSS 5.3 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Other injection, SQL injection - [kishor-23 food-waste-management-system donate.php sql injection](https://agentprime.io/advisories/CVE-2026-105167.md) `CVE-2026-105167` · CVE record: kishor-23 food-waste-management-system · CVSS 6.9 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Other injection, SQL injection - [kishor-23 food-waste-management-system Food Donation Form fooddonateform.php insert sql injection](https://agentprime.io/advisories/CVE-2026-105166.md) `CVE-2026-105166` · CVE record: kishor-23 food-waste-management-system · CVSS 6.9 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Other injection, SQL injection - [RainyGao DocSys Database Management BaseController.java BaseController.createDBForMysql sql injection](https://agentprime.io/advisories/CVE-2026-105158.md) `CVE-2026-105158` · CVE record: RainyGao DocSys · CVSS 6.9 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Other injection, SQL injection - [mooSocial all-products sql injection](https://agentprime.io/advisories/CVE-2026-105149.md) `CVE-2026-105149` · CVE record: mooSocial · CVSS 6.9 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Other injection, SQL injection - [Comsenz Discuz! Admin Medal Moderation mod.php modmedalsubmit sql injection](https://agentprime.io/advisories/CVE-2026-105146.md) `CVE-2026-105146` · CVE record: Comsenz Discuz! · CVSS 5.1 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Other injection, SQL injection - [WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-103355.md) `CVE-2026-103355` · CVE record: Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: SQL injection - [Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameter](https://agentprime.io/advisories/CVE-2026-18443.md) `CVE-2026-18443` · CVE record: storeapps Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) · CVSS 8.8 High · Not analysed yet · Published 3 Oct 2026 · Tags: SQL injection - [WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' Parameter](https://agentprime.io/advisories/CVE-2026-96267.md) `CVE-2026-96267` · CVE record: osamaesh WP Visitor Statistics (Real Time Traffic) · CVSS 7.5 High · Not analysed yet · Published 3 Oct 2026 · Tags: SQL injection - [Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscriber+ SQLi via get_addon_output_data](https://agentprime.io/advisories/CVE-2026-92923.md) `CVE-2026-92923` · CVE record: Unknown Unlimited Elements for Elementor · CVSS 6.3 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: SQL injection - [SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sort_column' and 'sort_order' Parameters](https://agentprime.io/advisories/CVE-2026-89236.md) `CVE-2026-89236` · CVE record: Unknown SaveTo Wishlist Lite · CVSS 8.6 High · Not analysed yet · Published 3 Oct 2026 · Tags: SQL injection - [Unlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQLi via 'ucs' Parameter](https://agentprime.io/advisories/CVE-2026-85568.md) `CVE-2026-85568` · CVE record: Unknown Unlimited Elements for Elementor · CVSS 6.8 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: SQL injection - [GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing](https://agentprime.io/advisories/CVE-2026-103913.md) `CVE-2026-103913` · CVE record: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory · CVSS 7.5 High · Not analysed yet · Published 3 Oct 2026 · Tags: SQL injection - [SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter](https://agentprime.io/advisories/CVE-2026-94539.md) `CVE-2026-94539` · CVE record: psmplugins SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent · CVSS 6.5 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: SQL injection - [Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields\[\]\[value\]' Parameter](https://agentprime.io/advisories/CVE-2026-95865.md) `CVE-2026-95865` · CVE record: beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder · CVSS 6.5 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: SQL injection - [Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name](https://agentprime.io/advisories/GHSA-9q4r-4842-93vw.md) `GHSA-9q4r-4842-93vw`, `CVE-2026-114081` · npm `trigger.dev`: affected `<4.5.6`, fixed in `4.5.6` · CVSS 8.3 High · Not analysed yet · Published 2 Oct 2026 · Tags: SQL injection, Broken access control - [UTMStack < 11.2.16 JPQL Injection via searchPropertyValues](https://agentprime.io/advisories/CVE-2026-82045.md) `CVE-2026-82045` · CVE record: UTMStack UTMStack · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: SQL injection - [UTMStack < 11.2.16 SQL Injection via searchGroupsByFilter](https://agentprime.io/advisories/CVE-2026-82039.md) `CVE-2026-82039` · CVE record: UTMStack UTMStack · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: SQL injection - [CodeAstro Simple Loan Management System index.php sql injection](https://agentprime.io/advisories/CVE-2026-104625.md) `CVE-2026-104625` · CVE record: CodeAstro Simple Loan Management System · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Other injection, SQL injection - [CodeAstro Simple Pharmacy Management System delete.php sql injection](https://agentprime.io/advisories/CVE-2026-104614.md) `CVE-2026-104614` · CVE record: CodeAstro Simple Pharmacy Management System · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Other injection, SQL injection - [CodeAstro Simple Pharmacy Management System view.php sql injection](https://agentprime.io/advisories/CVE-2026-104613.md) `CVE-2026-104613` · CVE record: CodeAstro Simple Pharmacy Management System · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Other injection, SQL injection - [SQL Injection in GG Soft's Paperwork](https://agentprime.io/advisories/CVE-2026-85215.md) `CVE-2026-85215` · CVE record: GG Soft Software Services Inc. Paperwork · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: SQL injection - [onetwothreeneth HospitalManagementSystem edit_accounts.php get sql injection](https://agentprime.io/advisories/CVE-2026-104609.md) `CVE-2026-104609` · CVE record: onetwothreeneth HospitalManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Other injection, SQL injection - [YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter](https://agentprime.io/advisories/CVE-2026-104462.md) `CVE-2026-104462` · CVE record: YesWiki yeswiki · CVSS 8.8 High · Not analysed yet · Published 2 Oct 2026 · Tags: SQL injection - [YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch](https://agentprime.io/advisories/CVE-2026-104460.md) `CVE-2026-104460` · CVE record: YesWiki yeswiki · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: SQL injection - [YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter](https://agentprime.io/advisories/CVE-2026-104457.md) `CVE-2026-104457` · CVE record: YesWiki yeswiki · CVSS 8.8 High · Not analysed yet · Published 2 Oct 2026 · Tags: SQL injection - [YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username](https://agentprime.io/advisories/CVE-2026-104456.md) `CVE-2026-104456` · CVE record: YesWiki yeswiki · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: SQL injection - [itsourcecode Online Admission System Project confirm.php sql injection](https://agentprime.io/advisories/CVE-2026-104606.md) `CVE-2026-104606` · CVE record: itsourcecode Online Admission System Project · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Other injection, SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .