# SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Xinhu Rainrock RockOA Openkqj Action openkqjAction.php returnchuli sql injection](https://agentprime.io/advisories/CVE-2026-108571.md)
  `CVE-2026-108571` · CVE record: Xinhu Rainrock RockOA · CVSS 6.9 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Other injection, SQL injection
- [Furion .NET Framework StringRenderExtensions.cs String.Replace sql injection](https://agentprime.io/advisories/CVE-2026-108569.md)
  `CVE-2026-108569` · CVE record: Furion .NET Framework · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Other injection, SQL injection
- [highwarden Super Store Finder index.php sql injection](https://agentprime.io/advisories/CVE-2026-108541.md)
  `CVE-2026-108541` · CVE record: highwarden Super Store Finder · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Other injection, SQL injection
- [Paymendo Bank Transfer <= 1.1 - Subscriber+ SQLi via 'orderBy' Parameter](https://agentprime.io/advisories/CVE-2026-89305.md)
  `CVE-2026-89305` · CVE record: Unknown paymendo · CVSS 6.5 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: SQL injection
- [Paymendo Bank Transfer <= 1.1 - Unauthenticated Blind SQLi via 'paymendo_bank_transfer_completed_payment' Parameter](https://agentprime.io/advisories/CVE-2026-89304.md)
  `CVE-2026-89304` · CVE record: Unknown paymendo · CVSS 6.5 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: SQL injection
- [Post Voting System <= 1.0 - Unauthenticated SQLi via 'id' Parameter](https://agentprime.io/advisories/CVE-2026-89302.md)
  `CVE-2026-89302` · CVE record: Unknown Post Voting System · CVSS 8.6 High · Not analysed yet · Published 11 Oct 2026 · Tags: SQL injection
- [WP Verify API <= 1.0.0 - Unauthenticated SQLi via 'verify' Parameter](https://agentprime.io/advisories/CVE-2026-89299.md)
  `CVE-2026-89299` · CVE record: Unknown WP Verify API · CVSS 8.6 High · Not analysed yet · Published 11 Oct 2026 · Tags: SQL injection
- [Loja Automática <= 1.0.0 - Unauthenticated SQLi via 'id' Parameter](https://agentprime.io/advisories/CVE-2026-89297.md)
  `CVE-2026-89297` · CVE record: Unknown Loja Automática · CVSS 8.6 High · Not analysed yet · Published 11 Oct 2026 · Tags: SQL injection
- [ASPL Product Quotation <= 1.1.0 - Unauthenticated SQLi via 'quote_id' Parameter](https://agentprime.io/advisories/CVE-2026-89287.md)
  `CVE-2026-89287` · CVE record: Unknown ASPL Product Quotation · CVSS 8.6 High · Not analysed yet · Published 11 Oct 2026 · Tags: SQL injection
- [Datalist it <= 0.0.3 - Unauthenticated SQLi via dli_fronted_action](https://agentprime.io/advisories/CVE-2026-89285.md)
  `CVE-2026-89285` · CVE record: Unknown Datalist it · CVSS 8.6 High · Not analysed yet · Published 11 Oct 2026 · Tags: SQL injection
- [WP-Partner <= 1.2.1 - Unauthenticated SQLi via 'id' Parameter](https://agentprime.io/advisories/CVE-2026-89234.md)
  `CVE-2026-89234` · CVE record: Unknown WP-Partner · CVSS 8.6 High · Not analysed yet · Published 11 Oct 2026 · Tags: SQL injection
- [RecordBrowser <= 1.1.7 - Unauthenticated SQLi via 'recordid' Parameter](https://agentprime.io/advisories/CVE-2026-89232.md)
  `CVE-2026-89232` · CVE record: Unknown Recordbrowser · CVSS 8.6 High · Not analysed yet · Published 11 Oct 2026 · Tags: SQL injection
- [WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQLi via Quiz Result Submission](https://agentprime.io/advisories/CVE-2026-89214.md)
  `CVE-2026-89214` · CVE record: Unknown WpCues Basic Quiz · CVSS 8.6 High · Not analysed yet · Published 11 Oct 2026 · Tags: SQL injection
- [Llavero.io <= 0.1.4 - Unauthenticated Blind SQLi via 'cill_login' Parameter](https://agentprime.io/advisories/CVE-2026-89213.md)
  `CVE-2026-89213` · CVE record: Unknown Llavero.io · CVSS 8.6 High · Not analysed yet · Published 11 Oct 2026 · Tags: SQL injection
- [Site Setup Wizard <= 1.5.8 - Unauthenticated SQLi via ssw_check_admin_email_exists](https://agentprime.io/advisories/CVE-2026-89195.md)
  `CVE-2026-89195` · CVE record: Unknown Site Setup Wizard · CVSS 8.6 High · Not analysed yet · Published 11 Oct 2026 · Tags: SQL injection
- [Social Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret](https://agentprime.io/advisories/CVE-2026-88930.md)
  `CVE-2026-88930` · CVE record: Unknown Social Web Suite · CVSS 8.6 High · Not analysed yet · Published 11 Oct 2026 · Tags: SQL injection
- [Tcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter](https://agentprime.io/advisories/CVE-2026-81420.md)
  `CVE-2026-81420` · CVE record: Unknown Tcard WP · CVSS 8.6 High · Not analysed yet · Published 11 Oct 2026 · Tags: SQL injection
- [Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'vendor_id' Parameter](https://agentprime.io/advisories/CVE-2026-103695.md)
  `CVE-2026-103695` · CVE record: Unknown Mobile builder · CVSS 8.6 High · Not analysed yet · Published 11 Oct 2026 · Tags: SQL injection
- [WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62117.md)
  `CVE-2026-62117` · CVE record: Dmitry V. Barcode Scanner with Inventory & Order Manager · CVSS 8.5 High · Not analysed yet · Published 10 Oct 2026 · Tags: SQL injection
- [WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62031.md)
  `CVE-2026-62031` · CVE record: Stylemix uListing · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: SQL injection
- [WordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-45440.md)
  `CVE-2026-45440` · CVE record: Smackcoders Inc. WP Ultimate CSV Importer · CVSS 7.6 High · Not analysed yet · Published 10 Oct 2026 · Tags: SQL injection
- [WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42722.md)
  `CVE-2026-42722` · CVE record: Shabti Kaplan Frontend Admin by DynamiApps · CVSS 7.6 High · Not analysed yet · Published 10 Oct 2026 · Tags: SQL injection
- [WordPress Leyka plugin <= 3.32.3 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42717.md)
  `CVE-2026-42717` · CVE record: VaultDweller Leyka · CVSS 7.6 High · Not analysed yet · Published 10 Oct 2026 · Tags: SQL injection
- [WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42712.md)
  `CVE-2026-42712` · CVE record: QODE Qode Tours · CVSS 8.5 High · Not analysed yet · Published 10 Oct 2026 · Tags: SQL injection
- [WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42633.md)
  `CVE-2026-42633` · CVE record: Marcus Events Manager · CVSS 8.5 High · Not analysed yet · Published 10 Oct 2026 · Tags: SQL injection
- [WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40800.md)
  `CVE-2026-40800` · CVE record: ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: SQL injection
- [WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-105889.md)
  `CVE-2026-105889` · CVE record: Tickera Tickera · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: SQL injection
- [WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)](https://agentprime.io/advisories/CVE-2026-96653.md)
  `CVE-2026-96653` · CVE record: wpdirectorykit WP Directory Kit · CVSS 6.5 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: SQL injection
- [Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking\[service_id\]' Parameter](https://agentprime.io/advisories/CVE-2026-96662.md)
  `CVE-2026-96662` · CVE record: latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress · CVSS 7.5 High · Not analysed yet · Published 10 Oct 2026 · Tags: SQL injection
- [WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter](https://agentprime.io/advisories/CVE-2026-107712.md)
  `CVE-2026-107712` · CVE record: murgroland WP Booking System – Booking Calendar · CVSS 6.5 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: SQL injection
- [LTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQLi via Shipping Rule 'edit_id' Parameter](https://agentprime.io/advisories/CVE-2026-87781.md)
  `CVE-2026-87781` · CVE record: Unknown LTL Freight Quotes · CVSS 8.6 High · Not analysed yet · Published 10 Oct 2026 · Tags: SQL injection
- [Rank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' Parameter](https://agentprime.io/advisories/CVE-2026-104753.md)
  `CVE-2026-104753` · CVE record: Unknown Rank Math SEO · CVSS 4.1 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: SQL injection
- [Smart Popup by Supsystic <= 1.13.2 - Authenticated (Administrator+) SQL Injection via 'sidx' Parameter](https://agentprime.io/advisories/CVE-2026-104023.md)
  `CVE-2026-104023` · CVE record: supsysticcom Smart Popup by Supsystic · CVSS 4.9 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: SQL injection
- [FireBox <= 3.1.13 - Authenticated (Author+) SQL Injection via FireBox Form Display Condition](https://agentprime.io/advisories/CVE-2026-104724.md)
  `CVE-2026-104724` · CVE record: fireplugins FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: SQL injection
- [SQL injection in JetBrains Exposed](https://agentprime.io/advisories/CVE-2026-108474.md)
  `CVE-2026-108474` · CVE record: JetBrains Exposed · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [WordPress Post Author Authenticated SQLi](https://agentprime.io/advisories/CVE-2026-108125.md)
  `CVE-2026-108125` · CVE record · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [WordPress Post Author Authenticated SQLi](https://agentprime.io/advisories/CVE-2026-108124.md)
  `CVE-2026-108124` · CVE record · CVSS 4.9 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php](https://agentprime.io/advisories/CVE-2026-108107.md)
  `CVE-2026-108107` · CVE record: hotspotbilling phpnuxbill · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [HortusFox before 6.2 SQL Injection via /api/locations/list include_info Parameter](https://agentprime.io/advisories/CVE-2026-108100.md)
  `CVE-2026-108100` · CVE record: danielbrendel hortusfox-web · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter](https://agentprime.io/advisories/CVE-2026-107803.md)
  `CVE-2026-107803` · CVE record: ProcessMaker processmaker · CVSS 6.5 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [Testimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated SQLi via 'offset' Parameter](https://agentprime.io/advisories/CVE-2026-89235.md)
  `CVE-2026-89235` · CVE record: Unknown Testimonials by BestWebSoft · CVSS 6.8 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93947.md)
  `CVE-2026-93947` · CVE record: Shinetheme Traveler · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94663.md)
  `CVE-2026-94663` · CVE record: Metagauss ProfileGrid · CVSS 8.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96809.md)
  `CVE-2026-96809` · CVE record: MultiNet Interactive AB EduAdmin Booking · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96331.md)
  `CVE-2026-96331` · CVE record: wpdreams Ajax Search Pro · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96330.md)
  `CVE-2026-96330` · CVE record: tagDiv tagDiv Opt-In Builder · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96329.md)
  `CVE-2026-96329` · CVE record: tagDiv tagDiv Opt-In Builder · CVSS 8.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96328.md)
  `CVE-2026-96328` · CVE record: jegtheme JNews - Pay Writer · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [WordPress Taskbuilder plugin <= 6.0.5 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-95599.md)
  `CVE-2026-95599` · CVE record: Taskbuilder Taskbuilder · CVSS 8.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [WordPress WPLMS theme <= 4.973 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-95607.md)
  `CVE-2026-95607` · CVE record: VibeThemes WPLMS · CVSS 8.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96327.md)
  `CVE-2026-96327` · CVE record: VibeThemes WPLMS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-95610.md)
  `CVE-2026-95610` · CVE record: UpSolution UpSolution Core · CVSS 8.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [Code Snippets < 3.10.0 - Admin+ SQLi in Migration Importers Leading to Network-Wide Credential Disclosure (Multisite)](https://agentprime.io/advisories/CVE-2026-106097.md)
  `CVE-2026-106097` · CVE record: Unknown Code Snippets · CVSS 6.8 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [Jivejdon through 5.0 SQL Injection via username in userListAction](https://agentprime.io/advisories/CVE-2025-71428.md)
  `CVE-2025-71428` · CVE record: banq jivejdon · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: SQL injection
- [Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection](https://agentprime.io/advisories/CVE-2026-80381.md)
  `CVE-2026-80381` · CVE record: IBM Guardium Data Protection · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: SQL injection
- [Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection](https://agentprime.io/advisories/CVE-2026-81932.md)
  `CVE-2026-81932` · CVE record: IBM Guardium Data Protection · CVSS 8.6 High · Not analysed yet · Published 8 Oct 2026 · Tags: SQL injection
- [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-84209.md)
  `CVE-2026-84209` · CVE record: IBM Guardium Data Protection · CVSS 8.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: SQL injection
- [Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-16830.md)
  `CVE-2026-16830` · CVE record: IBM Security Verify Access and 3 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: SQL injection
- [MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES](https://agentprime.io/advisories/GHSA-r3rv-jm3r-62q2.md)
  `GHSA-r3rv-jm3r-62q2`, `BIT-mariadb-2026-107385`, `BIT-mariadb-min-2026-107385`, `BIT-mysql-client-2026-107385`, `CVE-2026-107385` · npm `mariadb`: affected `<3.2.5 || >=3.3.0, <3.3.4 || >=3.4.0, <3.4.7 || >=3.5.0-rc.0, <3.5.4`, fixed in `3.2.5`, `3.3.4`, `3.4.7`, `3.5.4` · CVSS 7.4 High · Not analysed yet · Published 8 Oct 2026 · Tags: SQL injection
- [MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)](https://agentprime.io/advisories/GHSA-v6pj-gxxw-phfw.md)
  `GHSA-v6pj-gxxw-phfw`, `BIT-mariadb-2026-107384`, `BIT-mariadb-min-2026-107384`, `BIT-mysql-client-2026-107384`, `CVE-2026-107384` · npm `mariadb`: affected `>=3.2.0, <3.2.5 || >=3.3.0, <3.3.4 || >=3.4.0, <3.4.7 || >=3.5.0-rc.0, <3.5.4`, fixed in `3.2.5`, `3.3.4`, `3.4.7`, `3.5.4` · CVSS 8.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: SQL injection

Newest: <https://agentprime.io/advisories/tag/sql-injection.md>
Older: <https://agentprime.io/advisories/tag/sql-injection.md?cursor=WyIyMDI2LTEwLTA4VDE5OjQyOjIzLjAwMDAwMFoiLCJHSFNBLXY2cGotZ3h4dy1waGZ3Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=sql-injection&cursor=WyIyMDI2LTEwLTExVDE0OjQ1OjE0Ljc5MjAwMFoiLCJDVkUtMjAyNi0xMDg2ODQiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/sql-injection/?cursor=WyIyMDI2LTEwLTExVDE0OjQ1OjE0Ljc5MjAwMFoiLCJDVkUtMjAyNi0xMDg2ODQiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.