# SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort](https://agentprime.io/advisories/GHSA-r223-96jv-q533.md)
  `GHSA-r223-96jv-q533`, `CVE-2026-107375` · npm `generator-jhipster`: affected `>=7.0.0, <9.4.0`, fixed in `9.4.0` · CVSS 8.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: SQL injection
- [PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL](https://agentprime.io/advisories/GHSA-wf65-4jjx-q444.md)
  `GHSA-wf65-4jjx-q444`, `CVE-2026-60090`, `PYSEC-2026-4260` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: SQL injection, Other injection
- [WordPress Vitepos plugin <= 3.6.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-105076.md)
  `CVE-2026-105076` · CVE record: Appsbd Vitepos · CVSS 7.6 High · Not analysed yet · Published 8 Oct 2026 · Tags: SQL injection
- [SQL injection in the NetBoard CRM demo platform](https://agentprime.io/advisories/CVE-2026-12260.md)
  `CVE-2026-12260` · CVE record: NetBoard CRM NetBoard CRM Demo Platform · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: SQL injection
- [SQL injection in Brocade SANnav](https://agentprime.io/advisories/CVE-2026-5048.md)
  `CVE-2026-5048` · CVE record: Brocade Brocade SANnav · CVSS 6.1 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: SQL injection
- [Structured Query Language (SQL) Injection in the SPL2 Module Catalog in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76270.md)
  `CVE-2026-76270` · CVE record: Splunk Splunk Enterprise · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: SQL injection
- [Payload: SQL injection in SQLite/Postgres](https://agentprime.io/advisories/GHSA-pj7x-6wpf-pgvp.md)
  `GHSA-pj7x-6wpf-pgvp`, `CVE-2026-105856`, `CVE-2026-63316` · npm `@payloadcms/db-d1-sqlite` and 3 more: affected `>=3.0.0, <3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 8.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: SQL injection
- [WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-95605.md)
  `CVE-2026-95605` · CVE record: Passionate Programmer Peter WP Data Access · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: SQL injection
- [Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query](https://agentprime.io/advisories/GHSA-f46q-3v67-fmm4.md)
  `GHSA-f46q-3v67-fmm4`, `CVE-2026-62251`, `GO-2026-6672` · Go `github.com/sipcapture/homer-app`: affected `<0.0.0-20260625085520-a7d027dc684b`, fixed in `0.0.0-20260625085520-a7d027dc684b` · CVSS 8.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: SQL injection
- [Cisco Smart Software Manager On-Prem SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-76452.md)
  `CVE-2026-76452` · CVE record: Cisco Cisco License On-Prem · CVSS 4.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: SQL injection
- [WordPress WP Post Author plugin <= 4.0.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42708.md)
  `CVE-2026-42708` · CVE record: AF themes WP Post Author · CVSS 7.6 High · Not analysed yet · Published 7 Oct 2026 · Tags: SQL injection
- [WordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42710.md)
  `CVE-2026-42710` · CVE record: 10Web Slider by 10Web · CVSS 7.6 High · Not analysed yet · Published 7 Oct 2026 · Tags: SQL injection
- [WordPress Post title marquee scroll plugin <= 9.9 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42713.md)
  `CVE-2026-42713` · CVE record: Gopiplus Post title marquee scroll · CVSS 7.6 High · Not analysed yet · Published 7 Oct 2026 · Tags: SQL injection
- [WordPress Pix por Piggly (para Woocommerce) plugin <= 2.1.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42714.md)
  `CVE-2026-42714` · CVE record: Piggly Dev Pix por Piggly (para Woocommerce) · CVSS 7.6 High · Not analysed yet · Published 7 Oct 2026 · Tags: SQL injection
- [SQL injection in Six Apart Ltd. Movable Type Cloud Edition and others](https://agentprime.io/advisories/CVE-2026-103668.md)
  `CVE-2026-103668` · CVE record: Six Apart Ltd. Movable Type Cloud Edition and 3 more · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: SQL injection
- [WordPress Dynamic User Directory plugin <= 2.4 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42720.md)
  `CVE-2026-42720` · CVE record: Sarah Giles Dynamic User Directory · CVSS 7.6 High · Not analysed yet · Published 7 Oct 2026 · Tags: SQL injection
- [WordPress affiliate-toolkit plugin <= 3.9.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42721.md)
  `CVE-2026-42721` · CVE record: SERVIT Software Solutions affiliate-toolkit · CVSS 7.6 High · Not analysed yet · Published 7 Oct 2026 · Tags: SQL injection
- [SQL Injection Vulnerability in Manacle Technologies ERP System](https://agentprime.io/advisories/CVE-2026-107103.md)
  `CVE-2026-107103` · CVE record: Manacle Technologies Multi-tenant ERP System · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: SQL injection
- [Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0](https://agentprime.io/advisories/CVE-2026-102782.md)
  `CVE-2026-102782` · CVE record: ordasoft.com OrdaSoft Simple Membership extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: SQL injection
- [MPG < 4.2.3 - Editor+ SQLi via Project Import](https://agentprime.io/advisories/CVE-2026-104953.md)
  `CVE-2026-104953` · CVE record: Unknown MPG · CVSS 6.8 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: SQL injection
- [Animated Number Counters < 3.1 - Editor+ Second-Order SQLi via Counter Order](https://agentprime.io/advisories/CVE-2026-104667.md)
  `CVE-2026-104667` · CVE record: Unknown Animated Number Counters · CVSS 6.8 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: SQL injection
- [Authenticated SQL Injection allows Remote Code Execution in ClearPass Policy Manager API](https://agentprime.io/advisories/CVE-2026-79811.md)
  `CVE-2026-79811` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 7.2 High · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [Authenticated SQL Injection Vulnerabilities in ClearPass Policy Manager Web-Based Management Interface](https://agentprime.io/advisories/CVE-2026-79798.md)
  `CVE-2026-79798` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [Authenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management Interface](https://agentprime.io/advisories/CVE-2026-79794.md)
  `CVE-2026-79794` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [Payload: SQL Injection in SQLite and Postgres](https://agentprime.io/advisories/GHSA-v49j-62m6-pgrr.md)
  `GHSA-v49j-62m6-pgrr`, `CVE-2026-105845` · npm `payload`: affected `>=3.0.0, <3.88.0 || >=4.0.0-canary.0, <4.0.0-canary.27`, fixed in `3.88.0`, `4.0.0-canary.27` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [SourceCodester Performance Indicator System view_product.php sql injection](https://agentprime.io/advisories/CVE-2026-105957.md)
  `CVE-2026-105957` · CVE record: SourceCodester Performance Indicator System · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection, SQL injection
- [Kusalkasilva Learning-Management-System search_class.php sql injection](https://agentprime.io/advisories/CVE-2026-105921.md)
  `CVE-2026-105921` · CVE record: Kusalkasilva Learning-Management-System · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection, SQL injection
- [Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection](https://agentprime.io/advisories/CVE-2026-105920.md)
  `CVE-2026-105920` · CVE record: Kusalkasilva Learning-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection, SQL injection
- [Kusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection](https://agentprime.io/advisories/CVE-2026-105919.md)
  `CVE-2026-105919` · CVE record: Kusalkasilva Learning-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection, SQL injection
- [Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection](https://agentprime.io/advisories/CVE-2026-105918.md)
  `CVE-2026-105918` · CVE record: Kusalkasilva Learning-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection, SQL injection
- [WordPress Paid Member Subscriptions plugin <= 3.1.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-105317.md)
  `CVE-2026-105317` · CVE record: Cozmoslabs Paid Member Subscriptions · CVSS 8.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42417.md)
  `CVE-2026-42417` · CVE record: reputeinfosystems ARMember Premium · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [WordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42416.md)
  `CVE-2026-42416` · CVE record: AndonDesign UDesign Core · CVSS 8.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42415.md)
  `CVE-2026-42415` · CVE record: p-themes Porto Theme - Functionality · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42414.md)
  `CVE-2026-42414` · CVE record: CridioStudio ListingPro · CVSS 8.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <= 1.5.9 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-41555.md)
  `CVE-2026-41555` · CVE record: Weblizar – WordPress Themes & Plugin Newsletter Subscription Form – User Subscriptions Form, Capture Email · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39795.md)
  `CVE-2026-39795` · CVE record: brewlabs SendPress Newsletters · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [WordPress Gmedia Photo Gallery plugin <= 1.25.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39785.md)
  `CVE-2026-39785` · CVE record: Serhii Pasyuk Gmedia Photo Gallery · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39771.md)
  `CVE-2026-39771` · CVE record: MightyNetworks vs BuddyBoss Buddyboss Platform · CVSS 8.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.19 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39764.md)
  `CVE-2026-39764` · CVE record: RadiusTheme Radius Booking — Booking Calendar for Appointments \&amp; Services · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [WordPress Woffice theme < 5.4.43 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39747.md)
  `CVE-2026-39747` · CVE record: WofficeIO Woffice · CVSS 8.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [WordPress Booknetic plugin < 5.10.3 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39746.md)
  `CVE-2026-39746` · CVE record: Booknetic Booknetic · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [WordPress Mooberry Book Manager plugin 4.16.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-32581.md)
  `CVE-2026-32581` · CVE record: mooberrydreams Mooberry Book Manager · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [WordPress WooCommerce Lottery plugin <= 2.2.9 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-32580.md)
  `CVE-2026-32580` · CVE record: wpgenie WooCommerce Lottery · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [WordPress WooCommerce Appointments plugin <= 5.3.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-32557.md)
  `CVE-2026-32557` · CVE record: BookingWP WooCommerce Appointments · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [WordPress WP2LEADS plugin <= 3.5.7 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-25434.md)
  `CVE-2026-25434` · CVE record: Tobias @Saleswonder.biz WP2LEADS · CVSS 8.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies](https://agentprime.io/advisories/CVE-2026-4889.md)
  `CVE-2026-4889` · CVE record: RDL Technologies eLoanApp Platform · CVSS 7.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [SourceCodester Simple Student Information System searchquery.php sql injection](https://agentprime.io/advisories/CVE-2026-105807.md)
  `CVE-2026-105807` · CVE record: SourceCodester Simple Student Information System · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection, SQL injection
- [bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL admin_transaction.php sql injection](https://agentprime.io/advisories/CVE-2026-105776.md)
  `CVE-2026-105776` · CVE record: bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection, SQL injection
- [girishsaraf Online-Appointment-Booking-System Booking book.php sql injection](https://agentprime.io/advisories/CVE-2026-105472.md)
  `CVE-2026-105472` · CVE record: girishsaraf Online-Appointment-Booking-System · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection, SQL injection
- [LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL queries via crafted workflow templa…](https://agentprime.io/advisories/CVE-2025-45871.md)
  `CVE-2025-45871` · CVE record · CVSS 8.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [girishsaraf Online-Appointment-Booking-System Registration signup.php sql injection](https://agentprime.io/advisories/CVE-2026-105471.md)
  `CVE-2026-105471` · CVE record: girishsaraf Online-Appointment-Booking-System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection
- [girishsaraf Online-Appointment-Booking-System Doctor Search Endpoint locateus.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-105470.md)
  `CVE-2026-105470` · CVE record: girishsaraf Online-Appointment-Booking-System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection
- [girishsaraf Online-Appointment-Booking-System AJAX Endpoint get_town.php sql injection](https://agentprime.io/advisories/CVE-2026-105469.md)
  `CVE-2026-105469` · CVE record: girishsaraf Online-Appointment-Booking-System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection
- [girishsaraf Online-Appointment-Booking-System Login mlogin.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-105468.md)
  `CVE-2026-105468` · CVE record: girishsaraf Online-Appointment-Booking-System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection
- [feelec-yishu feelcrm-os Member Endpoint MemberController.class.php index sql injection](https://agentprime.io/advisories/CVE-2026-105388.md)
  `CVE-2026-105388` · CVE record: feelec-yishu feelcrm-os · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection
- [Maestro: sql identifier injection via properties.\* search filter and orderby field](https://agentprime.io/advisories/CVE-2026-71298.md)
  `CVE-2026-71298` · CVE record: Red Hat Multicluster Engine for Kubernetes · CVSS 6.4 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: SQL injection
- [WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-103066.md)
  `CVE-2026-103066` · CVE record: WP BASE WP BASE Booking · CVSS 8.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: SQL injection
- [girishsaraf Online-Appointment-Booking-System Patient Login cover.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-105387.md)
  `CVE-2026-105387` · CVE record: girishsaraf Online-Appointment-Booking-System · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection
- [onetwothreeneth HospitalManagementSystem print.php get sql injection](https://agentprime.io/advisories/CVE-2026-105386.md)
  `CVE-2026-105386` · CVE record: onetwothreeneth HospitalManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, SQL injection

Newest: <https://agentprime.io/advisories/tag/sql-injection.md>
Older: <https://agentprime.io/advisories/tag/sql-injection.md?cursor=WyIyMDI2LTEwLTA1VDE4OjMwOjE0LjgyNjAwMFoiLCJDVkUtMjAyNi0xMDUzODYiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=sql-injection&cursor=WyIyMDI2LTEwLTA4VDE5OjQyOjIzLjAwMDAwMFoiLCJHSFNBLXY2cGotZ3h4dy1waGZ3Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/sql-injection/?cursor=WyIyMDI2LTEwLTA4VDE5OjQyOjIzLjAwMDAwMFoiLCJHSFNBLXY2cGotZ3h4dy1waGZ3Il0>. Everything for agents: <https://agentprime.io/llms.txt>.