# SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [SQL Injection in HAVELSAN's Sef - AI Chatbot Platform](https://agentprime.io/advisories/CVE-2026-80298.md)
  `CVE-2026-80298` · CVE record: HAVELSAN Inc. Sef - AI Chatbot Platform · CVSS 8.8 High · Not analysed yet · Published 2 Oct 2026 · Tags: SQL injection
- [Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter](https://agentprime.io/advisories/CVE-2026-97634.md)
  `CVE-2026-97634` · CVE record: stellarwp Event Tickets and Registration · CVSS 6.5 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: SQL injection
- [MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter](https://agentprime.io/advisories/CVE-2026-12951.md)
  `CVE-2026-12951` · CVE record: wcmp MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions · CVSS 6.5 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: SQL injection
- [BuildKit < 1.0.29 - Contributor+ Stored SQLi via list_content Parameter](https://agentprime.io/advisories/CVE-2026-94298.md)
  `CVE-2026-94298` · CVE record: Unknown BuildKit · CVSS 6.2 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: SQL injection
- [SourceCodester Online Reviewer Management System btn_functions.php activity sql injection](https://agentprime.io/advisories/CVE-2026-104123.md)
  `CVE-2026-104123` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Other injection, SQL injection
- [itsourcecode Pet Shop Management System admin_reservefilter.php sql injection](https://agentprime.io/advisories/CVE-2026-104053.md)
  `CVE-2026-104053` · CVE record: itsourcecode Pet Shop Management System · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Other injection, SQL injection
- [itsourcecode Pet Shop Management System admin_reject_completed.php sql injection](https://agentprime.io/advisories/CVE-2026-104052.md)
  `CVE-2026-104052` · CVE record: itsourcecode Pet Shop Management System · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Other injection, SQL injection
- [ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter](https://agentprime.io/advisories/CVE-2026-103766.md)
  `CVE-2026-103766` · CVE record: MacWarrior clipbucket-v5 · CVSS 8.6 High · Not analysed yet · Published 1 Oct 2026 · Tags: SQL injection
- [Rubygem-katello: sql injection in registry proxy via labels](https://agentprime.io/advisories/CVE-2026-56097.md)
  `CVE-2026-56097` · CVE record: Red Hat Red Hat Satellite 6.16 for RHEL 8 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: SQL injection
- [itsourcecode Leave Management System controller.php sql injection](https://agentprime.io/advisories/CVE-2026-103690.md)
  `CVE-2026-103690` · CVE record: itsourcecode Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Other injection, SQL injection
- [SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking](https://agentprime.io/advisories/GHSA-33jq-p8c2-q3q4.md)
  `GHSA-33jq-p8c2-q3q4`, `CVE-2026-69085`, `GO-2026-6621` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260721043339-eef10568384e`, fixed in `0.0.0-20260721043339-eef10568384e` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: SQL injection
- [WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62071.md)
  `CVE-2026-62071` · CVE record: nickboss WordPress File Upload · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: SQL injection
- [WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62059.md)
  `CVE-2026-62059` · CVE record: Ultimate Member Ultimate Member · CVSS 7.6 High · Not analysed yet · Published 1 Oct 2026 · Tags: SQL injection
- [WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62060.md)
  `CVE-2026-62060` · CVE record: captivateaudio Captivate Sync · CVSS 7.6 High · Not analysed yet · Published 1 Oct 2026 · Tags: SQL injection
- [WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-102379.md)
  `CVE-2026-102379` · CVE record: VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder · CVSS 8.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: SQL injection
- [WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-103338.md)
  `CVE-2026-103338` · CVE record: Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) · CVSS 8.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: SQL injection
- [n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table](https://agentprime.io/advisories/CVE-2026-103253.md)
  `CVE-2026-103253` · CVE record: n8n-io n8n · CVSS 7.0 High · Not analysed yet · Published 1 Oct 2026 · Tags: SQL injection
- [n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase](https://agentprime.io/advisories/CVE-2026-103248.md)
  `CVE-2026-103248` · CVE record: n8n-io n8n · CVSS 7.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: SQL injection
- [SQL Injection in Grafana Integration Endpoint (query.php)](https://agentprime.io/advisories/CVE-2026-75786.md)
  `CVE-2026-75786` · CVE record: Pandora FMS Pandora FMS · CVSS 7.2 High · Not analysed yet · Published 1 Oct 2026 · Tags: SQL injection
- [Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameter](https://agentprime.io/advisories/CVE-2026-89296.md)
  `CVE-2026-89296` · CVE record: Unknown Pro Like Button · CVSS 8.6 High · Not analysed yet · Published 1 Oct 2026 · Tags: SQL injection
- [Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback](https://agentprime.io/advisories/CVE-2026-81809.md)
  `CVE-2026-81809` · CVE record: Unknown Paytm Payment Gateway · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: SQL injection
- [itsourcecode Leave Management System controller.php sql injection](https://agentprime.io/advisories/CVE-2026-103543.md)
  `CVE-2026-103543` · CVE record: itsourcecode Leave Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Other injection, SQL injection
- [Kiteworks Secure Data Forms SQL injection](https://agentprime.io/advisories/CVE-2026-102109.md)
  `CVE-2026-102109` · CVE record: Kiteworks Secure Data Forms · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [Kiteworks Core SQL Injection](https://agentprime.io/advisories/CVE-2026-102098.md)
  `CVE-2026-102098` · CVE record: Kiteworks Core · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [AdithyaYelloju Restaurant-Management-System table_booking.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-103232.md)
  `CVE-2026-103232` · CVE record: AdithyaYelloju Restaurant-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [AdithyaYelloju Restaurant-Management-System Order Cancellation cancel.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-103231.md)
  `CVE-2026-103231` · CVE record: AdithyaYelloju Restaurant-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [AdithyaYelloju Restaurant-Management-System Order Placement ord.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-103230.md)
  `CVE-2026-103230` · CVE record: AdithyaYelloju Restaurant-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [AdithyaYelloju Restaurant-Management-System Unauthenticated Action Script delete1.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-103229.md)
  `CVE-2026-103229` · CVE record: AdithyaYelloju Restaurant-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1](https://agentprime.io/advisories/CVE-2026-76570.md)
  `CVE-2026-76570` · CVE record: joomcode.com JCTables extension for Joomla · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [SQL Injection in Trex Digital Manufacturing's Trex MES](https://agentprime.io/advisories/CVE-2026-18782.md)
  `CVE-2026-18782` · CVE record: Trex Digital Smart Manufacturing Systems Inc. Trex MES · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [WordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62097.md)
  `CVE-2026-62097` · CVE record: WPTasty Business Directory · CVSS 7.6 High · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [Multiple Vulnerabilities in Dolusoft Software's SOPLOG](https://agentprime.io/advisories/CVE-2026-82307.md)
  `CVE-2026-82307` · CVE record: Dolusoft Software Technologies SOPLOG · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection](https://agentprime.io/advisories/CVE-2026-103117.md)
  `CVE-2026-103117` · CVE record: OS4ED openSIS-Classic · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [OS4ED openSIS-Classic Student List Search Endpoint GetStuListFnc.php DBQuery sql injection](https://agentprime.io/advisories/CVE-2026-103116.md)
  `CVE-2026-103116` · CVE record: OS4ED openSIS-Classic · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [WordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-97293.md)
  `CVE-2026-97293` · CVE record: David Lingren Media LIbrary Assistant · CVSS 8.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-97287.md)
  `CVE-2026-97287` · CVE record: Liquid Web / StellarWP Event Tickets · CVSS 8.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [WordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96828.md)
  `CVE-2026-96828` · CVE record: Vidish Category Discount Woocommerce · CVSS 7.6 High · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96827.md)
  `CVE-2026-96827` · CVE record: Melapress Admin Notices Manager · CVSS 7.6 High · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96822.md)
  `CVE-2026-96822` · CVE record: Hossni Mubarak Books Gallery · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96346.md)
  `CVE-2026-96346` · CVE record: weDevs WP ERP · CVSS 7.6 High · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96345.md)
  `CVE-2026-96345` · CVE record: Estatik Estatik · CVSS 7.6 High · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94177.md)
  `CVE-2026-94177` · CVE record: Ruben Garcia GamiPress · CVSS 8.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [WordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94115.md)
  `CVE-2026-94115` · CVE record: Fatcatapps Easy Pricing Tables · CVSS 8.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [WordPress Quiz Cat plugin <= 3.1.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94082.md)
  `CVE-2026-94082` · CVE record: Fatcatapps Quiz Cat · CVSS 7.6 High · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [WordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93621.md)
  `CVE-2026-93621` · CVE record: Passionate Programmer Peter WP Data Access · CVSS 8.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62085.md)
  `CVE-2026-62085` · CVE record: Melapress WP Activity Log · CVSS 7.6 High · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [OS4ED openSIS-Classic Student Search CustomFieldsFnc.php sql injection](https://agentprime.io/advisories/CVE-2026-103115.md)
  `CVE-2026-103115` · CVE record: OS4ED openSIS-Classic · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [OS4ED openSIS-Classic Assignment Management Endpoint Assignments.php DBQuery_assignment sql injection](https://agentprime.io/advisories/CVE-2026-103114.md)
  `CVE-2026-103114` · CVE record: OS4ED openSIS-Classic · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [OS4ED openSIS-Classic General Information Tab Student.php save action sql injection](https://agentprime.io/advisories/CVE-2026-103113.md)
  `CVE-2026-103113` · CVE record: OS4ED openSIS-Classic · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [Moodle: sql injection in question bank web service](https://agentprime.io/advisories/CVE-2026-102578.md)
  `CVE-2026-102578` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [DigiWin｜EasyFlow .NET - SQL Injection](https://agentprime.io/advisories/CVE-2026-102456.md)
  `CVE-2026-102456` · CVE record: DigiWin EasyFlow .NET · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter](https://agentprime.io/advisories/CVE-2026-16596.md)
  `CVE-2026-16596` · CVE record: wpdirectorykit WP Directory Kit · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters](https://agentprime.io/advisories/CVE-2026-6806.md)
  `CVE-2026-6806` · CVE record: stylemix Motors – Car Dealership & Classified Listings Plugin · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [SourceCodester Car Driving School Management System Master.php save_enrollment sql injection](https://agentprime.io/advisories/CVE-2026-102913.md)
  `CVE-2026-102913` · CVE record: SourceCodester Car Driving School Management System · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [SourceCodester Online Leave Management System page reports sql injection](https://agentprime.io/advisories/CVE-2026-102912.md)
  `CVE-2026-102912` · CVE record: SourceCodester Online Leave Management System · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [SourceCodester Online Reviewer Management System exam-delete.php sql injection](https://agentprime.io/advisories/CVE-2026-102910.md)
  `CVE-2026-102910` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [SourceCodester Online Reviewer Management System btn_functions.php sql injection](https://agentprime.io/advisories/CVE-2026-102909.md)
  `CVE-2026-102909` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [SourceCodester Online Reviewer Management System questions-view.php sql injection](https://agentprime.io/advisories/CVE-2026-102908.md)
  `CVE-2026-102908` · CVE record: SourceCodester Online Reviewer Management System · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, SQL injection
- [SQL injection in Zetetic SQLCipher](https://agentprime.io/advisories/CVE-2026-51936.md)
  `CVE-2026-51936` · CVE record: Zetetic SQLCipher · CVSS 2.1 Low · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [Toptech TMS7 and TopHAT SQL Injection](https://agentprime.io/advisories/CVE-2026-72507.md)
  `CVE-2026-72507` · CVE record: Toptech Systems TMS7 and 1 more · CVSS 8.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: SQL injection

Newest: <https://agentprime.io/advisories/tag/sql-injection.md>
Older: <https://agentprime.io/advisories/tag/sql-injection.md?cursor=WyIyMDI2LTA5LTI5VDIxOjM2OjUzLjkyODAwMFoiLCJDVkUtMjAyNi03MjUwNyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=sql-injection&cursor=WyIyMDI2LTEwLTAyVDEwOjMwOjE2LjQwNzAwMFoiLCJDVkUtMjAyNi0xMDQ2MDYiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/sql-injection/?cursor=WyIyMDI2LTEwLTAyVDEwOjMwOjE2LjQwNzAwMFoiLCJDVkUtMjAyNi0xMDQ2MDYiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.