# SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [satya-vinay Events-Management-System Registration-Delete dodelete.php sql injection](https://agentprime.io/advisories/CVE-2026-112142.md)
  `CVE-2026-112142` · CVE record: satya-vinay Events-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, SQL injection
- [satya-vinay Events-Management-System Registration-Edit doedit.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-112141.md)
  `CVE-2026-112141` · CVE record: satya-vinay Events-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, SQL injection
- [subhajitkhan online-clinic-management-system Administrative Mutation admindocview.php sql injection](https://agentprime.io/advisories/CVE-2026-112139.md)
  `CVE-2026-112139` · CVE record: subhajitkhan online-clinic-management-system · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, SQL injection
- [Apache Kylin: tables/names SparkSQL injection](https://agentprime.io/advisories/CVE-2026-108776.md)
  `CVE-2026-108776` · CVE record: Apache Software Foundation Apache Kylin · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: SQL injection
- [SQL Injection in the Integratec Application](https://agentprime.io/advisories/CVE-2026-13695.md)
  `CVE-2026-13695` · CVE record: Integratec Integratec · CVSS 8.8 High · Not analysed yet · Published 19 Oct 2026 · Tags: SQL injection
- [Dav-ee dairy-management-system pay.php mysqli_real_escape_string sql injection](https://agentprime.io/advisories/CVE-2026-112090.md)
  `CVE-2026-112090` · CVE record: Dav-ee dairy-management-system · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, SQL injection
- [Dav-ee dairy-management-system delete.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-112089.md)
  `CVE-2026-112089` · CVE record: Dav-ee dairy-management-system · CVSS 5.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, SQL injection
- [Dav-ee dairy-management-system add.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-112088.md)
  `CVE-2026-112088` · CVE record: Dav-ee dairy-management-system · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, SQL injection
- [itsourcecode Online Cake Ordering System confirm.php sql injection](https://agentprime.io/advisories/CVE-2026-112087.md)
  `CVE-2026-112087` · CVE record: itsourcecode Online Cake Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, SQL injection
- [SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.](https://agentprime.io/advisories/CVE-2026-107083.md)
  `CVE-2026-107083` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: SQL injection
- [Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index…](https://agentprime.io/advisories/CVE-2026-107082.md)
  `CVE-2026-107082` · CVE record · CVSS 8.8 High · Not analysed yet · Published 19 Oct 2026 · Tags: SQL injection
- [SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.…](https://agentprime.io/advisories/CVE-2026-107081.md)
  `CVE-2026-107081` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: SQL injection
- [aircheng-org iWebShop-5 util.php search sql injection](https://agentprime.io/advisories/CVE-2026-112032.md)
  `CVE-2026-112032` · CVE record: aircheng-org iWebShop-5 · CVSS 5.1 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Other injection, SQL injection
- [itsmeravitejak Online-Examination-System Exam exam.php startExam sql injection](https://agentprime.io/advisories/CVE-2026-111992.md)
  `CVE-2026-111992` · CVE record: itsmeravitejak Online-Examination-System · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Other injection, SQL injection
- [kishan0725 Hospital Management System Appointment Cancellation admin-panel.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-111990.md)
  `CVE-2026-111990` · CVE record: kishan0725 Hospital Management System · CVSS 6.9 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Other injection, SQL injection
- [JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass](https://agentprime.io/advisories/CVE-2026-112017.md)
  `CVE-2026-112017` · CVE record: jeecgboot JeecgBoot · CVSS 7.1 High · Not analysed yet · Published 18 Oct 2026 · Tags: SQL injection
- [WordPress Support Genix plugin <= 1.4.54 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-110895.md)
  `CVE-2026-110895` · CVE record: DevItems Support Genix · CVSS 8.5 High · Not analysed yet · Published 18 Oct 2026 · Tags: SQL injection
- [WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-109894.md)
  `CVE-2026-109894` · CVE record: Arraytics Booktics · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Oct 2026 · Tags: SQL injection
- [Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export](https://agentprime.io/advisories/CVE-2026-96534.md)
  `CVE-2026-96534` · CVE record: Unknown Modern Events Calendar Lite and 1 more · CVSS 7.7 High · Not analysed yet · Published 18 Oct 2026 · Tags: SQL injection
- [itsmeravitejak Online-Examination-System AJAX Endpoint exammanger.php topicslist sql injection](https://agentprime.io/advisories/CVE-2026-111873.md)
  `CVE-2026-111873` · CVE record: itsmeravitejak Online-Examination-System · CVSS 6.9 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Other injection, SQL injection
- [itsmeravitejak Online-Examination-System database.php getreport sql injection](https://agentprime.io/advisories/CVE-2026-111872.md)
  `CVE-2026-111872` · CVE record: itsmeravitejak Online-Examination-System · CVSS 6.9 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Other injection, SQL injection
- [itsmeravitejak Online-Examination-System subjectsdb.php sql injection](https://agentprime.io/advisories/CVE-2026-111871.md)
  `CVE-2026-111871` · CVE record: itsmeravitejak Online-Examination-System · CVSS 6.9 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Other injection, SQL injection
- [nemoTyrant manong func.php arr2sql sql injection](https://agentprime.io/advisories/CVE-2026-111866.md)
  `CVE-2026-111866` · CVE record: nemoTyrant manong · CVSS 6.9 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Other injection, SQL injection
- [Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name](https://agentprime.io/advisories/CVE-2026-104122.md)
  `CVE-2026-104122` · CVE record: Unknown Ukr-To-Lat · CVSS 6.8 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: SQL injection
- [BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-91074.md)
  `CVE-2026-91074` · CVE record: Unknown BSK PDF Manager · CVSS 6.8 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: SQL injection
- [Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie](https://agentprime.io/advisories/CVE-2026-107752.md)
  `CVE-2026-107752` · CVE record: uscnanbu Welcart e-Commerce · CVSS 4.9 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: SQL injection
- [Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report](https://agentprime.io/advisories/CVE-2026-55796.md)
  `CVE-2026-55796` · CVE record: frappe hrms · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [AipexBase through commit 690adb9 SQL Injection via /api/data/invoke](https://agentprime.io/advisories/CVE-2026-111718.md)
  `CVE-2026-111718` · CVE record: kuafuai aipexbase · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [WebVella ERP through 1.8.8 SQL Injection via EQL Query API](https://agentprime.io/advisories/CVE-2026-111700.md)
  `CVE-2026-111700` · CVE record: WebVella WebVella-ERP · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum](https://agentprime.io/advisories/CVE-2026-111686.md)
  `CVE-2026-111686` · CVE record: Thecosy IceCMS · CVSS 8.7 High · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [IceCMS through 4.1.5 SQL Injection via /WebResource/findresourcebynum](https://agentprime.io/advisories/CVE-2026-111685.md)
  `CVE-2026-111685` · CVE record: Thecosy IceCMS · CVSS 8.7 High · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BY](https://agentprime.io/advisories/CVE-2026-111669.md)
  `CVE-2026-111669` · CVE record: izhaorui Zr.Admin.NET · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [Helical Insight through 7.0.0 SQL Injection via /executeDatasource](https://agentprime.io/advisories/CVE-2026-111634.md)
  `CVE-2026-111634` · CVE record: helicalinsight helicalinsight · CVSS 8.6 High · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [FilePress through 3.0.1 SQL Injection via asc Parameter in filelist.php](https://agentprime.io/advisories/CVE-2026-111619.md)
  `CVE-2026-111619` · CVE record: zyx0814 FilePress · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [PeerBanHelper: SQL injection via ${field} interpolation in MyBatis mapper for analysis endpoint](https://agentprime.io/advisories/CVE-2026-62362.md)
  `CVE-2026-62362` · CVE record: PBH-BTN PeerBanHelper · CVSS 4.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [MariaDB: Insufficient quoting in mariadb-dump and SHOW commands](https://agentprime.io/advisories/CVE-2026-86047.md)
  `CVE-2026-86047` · CVE record: MariaDB server · CVSS 7.7 High · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [WordPress MapSVG plugin <= 8.16.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-111399.md)
  `CVE-2026-111399` · CVE record: PT Norther Lights Production MapSVG · CVSS 8.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [Apache Kylin: Missing authentication on certain cache API endpoints](https://agentprime.io/advisories/CVE-2026-64959.md)
  `CVE-2026-64959` · CVE record: Apache Software Foundation Apache Kylin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection, Authentication bypass
- [Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table API](https://agentprime.io/advisories/CVE-2026-111390.md)
  `CVE-2026-111390` · CVE record: erupts erupt · CVSS 6.0 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [SQL injection in TSG Profleet](https://agentprime.io/advisories/CVE-2026-111472.md)
  `CVE-2026-111472` · CVE record: TSG Profleet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter](https://agentprime.io/advisories/CVE-2026-92766.md)
  `CVE-2026-92766` · CVE record: appsbd Vitepos – Point of Sale (POS) for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94388.md)
  `CVE-2026-94388` · CVE record: halfdata Green Popups · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter](https://agentprime.io/advisories/CVE-2026-111178.md)
  `CVE-2026-111178` · CVE record: murgroland WP Booking System – Booking Calendar · CVSS 4.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter](https://agentprime.io/advisories/CVE-2026-110179.md)
  `CVE-2026-110179` · CVE record: Unknown affiliate-toolkit · CVSS 6.8 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' Parameter](https://agentprime.io/advisories/CVE-2026-103696.md)
  `CVE-2026-103696` · CVE record: Unknown Mobile builder · CVSS 6.8 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' Parameter](https://agentprime.io/advisories/CVE-2026-91833.md)
  `CVE-2026-91833` · CVE record: Unknown WX Subscribe 微信支付付费订阅 · CVSS 6.8 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by\[\].val' Parameter via 'bt' Operator](https://agentprime.io/advisories/CVE-2026-109414.md)
  `CVE-2026-109414` · CVE record: appsbd Vitepos – Point of Sale (POS) for WooCommerce · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter](https://agentprime.io/advisories/CVE-2026-111106.md)
  `CVE-2026-111106` · CVE record: getwpfunnels Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation](https://agentprime.io/advisories/CVE-2026-93953.md)
  `CVE-2026-93953` · CVE record: softaculous Backuply – Backup, Restore, Migrate and Clone · CVSS 8.0 High · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys](https://agentprime.io/advisories/CVE-2026-103518.md)
  `CVE-2026-103518` · CVE record: wpmanageninja FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler · CVSS 4.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [SQL injection in Wheels](https://agentprime.io/advisories/CVE-2026-111444.md)
  `CVE-2026-111444` · CVE record: Wheels Wheels · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation](https://agentprime.io/advisories/CVE-2026-111389.md)
  `CVE-2026-111389` · CVE record: frappe hrms · CVSS 8.3 High · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [GYM One: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in admin/users/index.php](https://agentprime.io/advisories/CVE-2026-55871.md)
  `CVE-2026-55871` · CVE record: mayerbalintdev GYM-One · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: SQL injection
- [Tianji: SQL Injection via unsanitized timezone parameter in analytics queries](https://agentprime.io/advisories/CVE-2026-55239.md)
  `CVE-2026-55239` · CVE record: msgbyte tianji · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: SQL injection
- [EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression](https://agentprime.io/advisories/CVE-2026-53574.md)
  `CVE-2026-53574` · CVE record: espocrm espocrm · CVSS 7.6 High · Not analysed yet · Published 15 Oct 2026 · Tags: SQL injection
- [WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-109688.md)
  `CVE-2026-109688` · CVE record: Link Whisper INC Link Whisper Free · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: SQL injection
- [WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-109698.md)
  `CVE-2026-109698` · CVE record: Kitae Park Mang Board WP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: SQL injection
- [WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-108497.md)
  `CVE-2026-108497` · CVE record: TMS Amelia · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: SQL injection
- [SQLi#2 SQL Injection in class_videos.php getSmartVideosByOffset](https://agentprime.io/advisories/CVE-2026-26245.md)
  `CVE-2026-26245` · CVE record: QNAP Systems Inc. Video Station · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: SQL injection
- [SQLi#1 SQL Injection in class_videos.php \_getFilters](https://agentprime.io/advisories/CVE-2026-26244.md)
  `CVE-2026-26244` · CVE record: QNAP Systems Inc. Video Station · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: SQL injection

Newest: <https://agentprime.io/advisories/tag/sql-injection.md>
Older: <https://agentprime.io/advisories/tag/sql-injection.md?cursor=WyIyMDI2LTEwLTE1VDA5OjI5OjM2LjQ0MDAwMFoiLCJDVkUtMjAyNi0yNjI0NCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=sql-injection&cursor=WyIyMDI2LTEwLTE5VDE0OjQ1OjE4LjE0NTAwMFoiLCJDVkUtMjAyNi0xMTIxNTAiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/sql-injection/?cursor=WyIyMDI2LTEwLTE5VDE0OjQ1OjE4LjE0NTAwMFoiLCJDVkUtMjAyNi0xMTIxNTAiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.