# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [SQL Injection in WebCTI](https://agentprime.io/advisories/CVE-2026-63314.md) `CVE-2026-63314` · CVE record: Slican IPx · CVSS 8.7 High · Not analysed yet · Published 15 Oct 2026 · Tags: SQL injection - [Link Library <= 7.9.2 - Unauthenticated SQL Injection via 'link_url' Parameter](https://agentprime.io/advisories/CVE-2026-15090.md) `CVE-2026-15090` · CVE record: jackdewey Link Library · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: SQL injection - [SQL injection in Znuny](https://agentprime.io/advisories/CVE-2026-93484.md) `CVE-2026-93484` · CVE record: Znuny Znuny · CVSS 8.6 High · Not analysed yet · Published 15 Oct 2026 · Tags: SQL injection - [SQL injection in Wheels](https://agentprime.io/advisories/CVE-2026-110911.md) `CVE-2026-110911` · CVE record: Wheels Wheels · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: SQL injection - [n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field](https://agentprime.io/advisories/CVE-2026-110840.md) `CVE-2026-110840` · CVE record: n8n-io n8n · CVSS 7.0 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [cemtan sar2html Archive Processing sar2html.py updateDb sql injection](https://agentprime.io/advisories/CVE-2026-110670.md) `CVE-2026-110670` · CVE record: cemtan sar2html · CVSS 6.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Other injection, SQL injection - [WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php](https://agentprime.io/advisories/CVE-2026-55684.md) `CVE-2026-55684` · CVE record: LabRedesCefetRJ WeGIA · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [WeGIA: SQL Injection in html/matPat/restaurar_produto_desocultar.php via id_produto parameter](https://agentprime.io/advisories/CVE-2026-55681.md) `CVE-2026-55681` · CVE record: LabRedesCefetRJ WeGIA · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection](https://agentprime.io/advisories/CVE-2026-55679.md) `CVE-2026-55679` · CVE record: LabRedesCefetRJ WeGIA · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection, SQL injection, Code injection - [WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter](https://agentprime.io/advisories/CVE-2026-55680.md) `CVE-2026-55680` · CVE record: LabRedesCefetRJ WeGIA · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php](https://agentprime.io/advisories/CVE-2026-55683.md) `CVE-2026-55683` · CVE record: LabRedesCefetRJ WeGIA · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [cemtan sar2html sar2html.py index sql injection](https://agentprime.io/advisories/CVE-2026-110668.md) `CVE-2026-110668` · CVE record: cemtan sar2html · CVSS 6.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Other injection, SQL injection - [InvoiceShelf ORDER BY SQL injection through orderByField](https://agentprime.io/advisories/CVE-2026-55386.md) `CVE-2026-55386` · CVE record: InvoiceShelf InvoiceShelf · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [DataEase: Stored SQL Injection in group-field binning bounds](https://agentprime.io/advisories/CVE-2026-104142.md) `CVE-2026-104142` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [DataEase: SQL Injection in datasource metadata identifiers](https://agentprime.io/advisories/CVE-2026-104141.md) `CVE-2026-104141` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username](https://agentprime.io/advisories/CVE-2026-55572.md) `CVE-2026-55572` · CVE record: e107inc e107 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [Redash: SQL Injection via Query Results parameterized query substitution](https://agentprime.io/advisories/CVE-2026-42093.md) `CVE-2026-42093` · CVE record: getredash redash · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [Junos OS: SRX Series: A network-based attacker causes Remote Code Execution when Security Intelligence is used without a tls-profile authentication](https://agentprime.io/advisories/CVE-2026-101997.md) `CVE-2026-101997` · CVE record: Juniper Networks Junos OS · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [SQL Injection](https://agentprime.io/advisories/CVE-2026-103946.md) `CVE-2026-103946` · CVE record: Tenable, Inc. Nessus · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [MOVEit Transfer SQL injection in custom reporting](https://agentprime.io/advisories/CVE-2026-89076.md) `CVE-2026-89076` · CVE record: Progress MOVEit Transfer · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [Yiuman citrus through 0.15.0 ORDER BY SQL Injection via sortBy Parameter](https://agentprime.io/advisories/CVE-2026-110614.md) `CVE-2026-110614` · CVE record: Yiuman citrus · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter](https://agentprime.io/advisories/CVE-2026-110609.md) `CVE-2026-110609` · CVE record: dromara skyeye · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [SQL injection in Dell PowerScale InsightIQ](https://agentprime.io/advisories/CVE-2026-94348.md) `CVE-2026-94348` · CVE record: Dell PowerScale InsightIQ · CVSS 6.1 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce](https://agentprime.io/advisories/CVE-2026-108065.md) `CVE-2026-108065` · CVE record: Channel Software WebAlliance eCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [HPE NonStop TSQLEXE - Memory Corruption vulnerability](https://agentprime.io/advisories/CVE-2026-73796.md) `CVE-2026-73796` · CVE record: Hewlett Packard Enterprise HPE NonStop TSQLEXE · CVSS 4.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-105067.md) `CVE-2026-105067` · CVE record: Webnus Modern Events Calendar Lite · CVSS 8.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters](https://agentprime.io/advisories/CVE-2026-105107.md) `CVE-2026-105107` · CVE record: Koha Community Koha · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-109901.md) `CVE-2026-109901` · CVE record: Codepeople CP Multi View Event Calendar · CVSS 8.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [SQL Command Injection Vulnerability in JTL-WMS](https://agentprime.io/advisories/CVE-2026-89310.md) `CVE-2026-89310` · CVE record: JTL SW GmbH JTL-WMS · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter](https://agentprime.io/advisories/CVE-2026-89288.md) `CVE-2026-89288` · CVE record: Unknown Fast Courier · CVSS 8.6 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook](https://agentprime.io/advisories/CVE-2026-103307.md) `CVE-2026-103307` · CVE record: Unknown Walletdoc Payment Gateway for WooCommerce · CVSS 8.6 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [Hyyan WooCommerce Polylang Integration <= 1.5.0 - Authenticated (Subscriber+) SQL Injection via 'variation_ids' Parameter](https://agentprime.io/advisories/CVE-2026-101926.md) `CVE-2026-101926` · CVE record: hyyan Hyyan WooCommerce Polylang Integration · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter](https://agentprime.io/advisories/CVE-2026-95808.md) `CVE-2026-95808` · CVE record: 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injection](https://agentprime.io/advisories/CVE-2026-78193.md) `CVE-2026-78193` · CVE record: ntbyk JTL-Connector for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection via 'gmedia\_\_in' Parameter](https://agentprime.io/advisories/CVE-2026-96661.md) `CVE-2026-96661` · CVE record: pasyuk Gmedia Photo Gallery · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via AES-CTR Ciphertext Forgery in 'validate' Parameter](https://agentprime.io/advisories/CVE-2026-102251.md) `CVE-2026-102251` · CVE record: Tyche Softwares Abandoned Cart Pro for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value](https://agentprime.io/advisories/CVE-2026-97668.md) `CVE-2026-97668` · CVE record: Tyche Softwares Abandoned Cart Pro for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection - [Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter](https://agentprime.io/advisories/CVE-2026-63165.md) `CVE-2026-63165` · CVE record: Omnispace Agora Project · CVSS 8.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection - [Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via \_idCategoryFilter](https://agentprime.io/advisories/CVE-2026-63152.md) `CVE-2026-63152` · CVE record: Omnispace Agora Project · CVSS 8.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection - [Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields\[\]](https://agentprime.io/advisories/CVE-2026-63154.md) `CVE-2026-63154` · CVE record: Omnispace Agora Project · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection - [Adobe Experience Manager | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-110083.md) `CVE-2026-110083` · CVE record: Adobe Adobe Experience Manager 6.5 · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection - [Configuration Manager Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-88075.md) `CVE-2026-88075` · CVE record: Microsoft Microsoft Configuration Manager and 2 more · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection - [Microsoft Configuration Manager Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-70049.md) `CVE-2026-70049` · CVE record: Microsoft Microsoft Configuration Manager and 2 more · CVSS 8.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection - [Microsoft Office SharePoint Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-70266.md) `CVE-2026-70266` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection - [SQL injection in Fortinet FortiManager Cloud and others](https://agentprime.io/advisories/CVE-2026-23707.md) `CVE-2026-23707` · CVE record: Fortinet FortiManager Cloud and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection - [SQL injection in Fortinet FortiAnalyzer Cloud and others](https://agentprime.io/advisories/CVE-2026-23706.md) `CVE-2026-23706` · CVE record: Fortinet FortiAnalyzer Cloud and 2 more · CVSS 5.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection - [SQL injection in Fortinet FortiAnalyzer and others](https://agentprime.io/advisories/CVE-2026-23705.md) `CVE-2026-23705` · CVE record: Fortinet FortiAnalyzer and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection - [SQL injection in Fortinet FortiAnalyzer Cloud and others](https://agentprime.io/advisories/CVE-2025-46773.md) `CVE-2025-46773` · CVE record: Fortinet FortiAnalyzer Cloud and 1 more · CVSS 7.9 High · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection - [SQL injection in Fortinet FortiMail](https://agentprime.io/advisories/CVE-2025-57739.md) `CVE-2025-57739` · CVE record: Fortinet FortiMail · CVSS 7.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection - [Frappe: Possibility of SQL injection in reportview](https://agentprime.io/advisories/CVE-2026-55823.md) `CVE-2026-55823` · CVE record: frappe frappe · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection - [SourceCodester Online Reviewer System index.php prepare sql injection](https://agentprime.io/advisories/CVE-2026-109620.md) `CVE-2026-109620` · CVE record: SourceCodester Online Reviewer System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Online Exam System Login Endpoint loginExe.php sql injection](https://agentprime.io/advisories/CVE-2026-109607.md) `CVE-2026-109607` · CVE record: SourceCodester Online Exam System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Art Gallery Management System Account Creation admin_class.php save_user sql injection](https://agentprime.io/advisories/CVE-2026-109606.md) `CVE-2026-109606` · CVE record: SourceCodester Art Gallery Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection - [girishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injection](https://agentprime.io/advisories/CVE-2026-109523.md) `CVE-2026-109523` · CVE record: girishsaraf Online-Appointment-Booking-System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection - [girishsaraf Online-Appointment-Booking-System Admin CRUD Endpoint deleteclinic.php sql injection](https://agentprime.io/advisories/CVE-2026-109522.md) `CVE-2026-109522` · CVE record: girishsaraf Online-Appointment-Booking-System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection - [girishsaraf Online-Appointment-Booking-System changebookingstatus.php sql injection](https://agentprime.io/advisories/CVE-2026-109521.md) `CVE-2026-109521` · CVE record: girishsaraf Online-Appointment-Booking-System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection - [SQL injection in Siemens RUGGEDCOM CROSSBOW](https://agentprime.io/advisories/CVE-2026-89201.md) `CVE-2026-89201` · CVE record: Siemens RUGGEDCOM CROSSBOW · CVSS 7.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection - [SQL injection in Siemens RUGGEDCOM CROSSBOW](https://agentprime.io/advisories/CVE-2026-89200.md) `CVE-2026-89200` · CVE record: Siemens RUGGEDCOM CROSSBOW · CVSS 8.4 High · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection - [SQL injection in Siemens RUGGEDCOM CROSSBOW](https://agentprime.io/advisories/CVE-2026-89198.md) `CVE-2026-89198` · CVE record: Siemens RUGGEDCOM CROSSBOW · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection - [SQL injection in Siemens RUGGEDCOM CROSSBOW](https://agentprime.io/advisories/CVE-2026-89197.md) `CVE-2026-89197` · CVE record: Siemens RUGGEDCOM CROSSBOW · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .