# SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [SQL injection in Siemens RUGGEDCOM CROSSBOW](https://agentprime.io/advisories/CVE-2026-89196.md)
  `CVE-2026-89196` · CVE record: Siemens RUGGEDCOM CROSSBOW · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection
- [WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-109687.md)
  `CVE-2026-109687` · CVE record: Link Whisper INC Link Whisper Free · CVSS 7.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection
- [WordPress WOLF plugin <= 1.1.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-108179.md)
  `CVE-2026-108179` · CVE record: PluginUs.Net WOLF · CVSS 7.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection
- [AdithyaYelloju Restaurant-Management-System Password Reset forgot3.php sql injection](https://agentprime.io/advisories/CVE-2026-109115.md)
  `CVE-2026-109115` · CVE record: AdithyaYelloju Restaurant-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection
- [Animated Number Counters <= 3.0 - Authenticated (Editor+) SQL Injection via 'counterid' Parameter](https://agentprime.io/advisories/CVE-2026-15399.md)
  `CVE-2026-15399` · CVE record: wpmart Animated Number Counters · CVSS 4.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection
- [itsmeravitejak Online-Examination-System Registration Form database.php addNewUser sql injection](https://agentprime.io/advisories/CVE-2026-108970.md)
  `CVE-2026-108970` · CVE record: itsmeravitejak Online-Examination-System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection
- [SourceCodester Performance Indicator System sales_history.php sql injection](https://agentprime.io/advisories/CVE-2026-108968.md)
  `CVE-2026-108968` · CVE record: SourceCodester Performance Indicator System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection
- [SourceCodester Performance Indicator System edit_credit.php sql injection](https://agentprime.io/advisories/CVE-2026-108967.md)
  `CVE-2026-108967` · CVE record: SourceCodester Performance Indicator System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection
- [SourceCodester Performance Indicator System product.php sql injection](https://agentprime.io/advisories/CVE-2026-108966.md)
  `CVE-2026-108966` · CVE record: SourceCodester Performance Indicator System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection
- [SourceCodester Performance Indicator System edit_quantity.php sql injection](https://agentprime.io/advisories/CVE-2026-108965.md)
  `CVE-2026-108965` · CVE record: SourceCodester Performance Indicator System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection
- [SourceCodester Performance Indicator System addproduct.php sql injection](https://agentprime.io/advisories/CVE-2026-108964.md)
  `CVE-2026-108964` · CVE record: SourceCodester Performance Indicator System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection
- [itsourcecode Online Cake Ordering System addtransacdetail.php sql injection](https://agentprime.io/advisories/CVE-2026-108959.md)
  `CVE-2026-108959` · CVE record: itsourcecode Online Cake Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection
- [code-projects Online Reviewer System User Update btn_functions.php sql injection](https://agentprime.io/advisories/CVE-2026-108956.md)
  `CVE-2026-108956` · CVE record: code-projects Online Reviewer System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, SQL injection
- [SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code)](https://agentprime.io/advisories/CVE-2026-89113.md)
  `CVE-2026-89113` · CVE record: SAP_SE SAP Commerce Cloud (OOTB Code) · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation](https://agentprime.io/advisories/CVE-2026-109674.md)
  `CVE-2026-109674` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters](https://agentprime.io/advisories/CVE-2026-109663.md)
  `CVE-2026-109663` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests](https://agentprime.io/advisories/CVE-2026-109649.md)
  `CVE-2026-109649` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation](https://agentprime.io/advisories/CVE-2026-109648.md)
  `CVE-2026-109648` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation](https://agentprime.io/advisories/CVE-2026-109647.md)
  `CVE-2026-109647` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation](https://agentprime.io/advisories/CVE-2026-109646.md)
  `CVE-2026-109646` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests](https://agentprime.io/advisories/CVE-2026-109639.md)
  `CVE-2026-109639` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation](https://agentprime.io/advisories/CVE-2026-109638.md)
  `CVE-2026-109638` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints](https://agentprime.io/advisories/CVE-2026-109634.md)
  `CVE-2026-109634` · CVE record: frappe erpnext · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation](https://agentprime.io/advisories/CVE-2026-109631.md)
  `CVE-2026-109631` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints](https://agentprime.io/advisories/CVE-2026-109626.md)
  `CVE-2026-109626` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation](https://agentprime.io/advisories/CVE-2026-109609.md)
  `CVE-2026-109609` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input](https://agentprime.io/advisories/CVE-2026-109608.md)
  `CVE-2026-109608` · CVE record: frappe erpnext · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint](https://agentprime.io/advisories/CVE-2026-109573.md)
  `CVE-2026-109573` · CVE record: thorsten phpMyFAQ · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [itsourcecode Online Admission System sum.php sql injection](https://agentprime.io/advisories/CVE-2026-108928.md)
  `CVE-2026-108928` · CVE record: itsourcecode Online Admission System · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [itsourcecode Baptism Information Management System pbaptism.php sql injection](https://agentprime.io/advisories/CVE-2026-108927.md)
  `CVE-2026-108927` · CVE record: itsourcecode Baptism Information Management System · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [itsourcecode Baptism Information Management System ebaptism.php sql injection](https://agentprime.io/advisories/CVE-2026-108926.md)
  `CVE-2026-108926` · CVE record: itsourcecode Baptism Information Management System · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [LibreNMS before 26.9.0 SQL Injection via notification_id in notifications.inc.php](https://agentprime.io/advisories/CVE-2026-109353.md)
  `CVE-2026-109353` · CVE record: librenms librenms · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Exponent CMS XML-RPC xmlrpc.php userLogin sql injection](https://agentprime.io/advisories/CVE-2026-108900.md)
  `CVE-2026-108900` · CVE record: Exponent CMS · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [LogicalDOC Community Edition through 9.3 HQL Injection via documents.xml indexed Parameter](https://agentprime.io/advisories/CVE-2026-109170.md)
  `CVE-2026-109170` · CVE record: LogicalDOC LogicalDOC Community Edition · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [LogicalDOC Community Edition through 9.3 SQL Injection via tags.xml firstLetter](https://agentprime.io/advisories/CVE-2026-109169.md)
  `CVE-2026-109169` · CVE record: LogicalDOC LogicalDOC Community Edition · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Zen Cart Module Configuration modules.php sql injection](https://agentprime.io/advisories/CVE-2026-108829.md)
  `CVE-2026-108829` · CVE record: Zen Cart · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [Zen Cart Admin Panel configuration.php eval sql injection](https://agentprime.io/advisories/CVE-2026-108828.md)
  `CVE-2026-108828` · CVE record: Zen Cart · CVSS 2.1 Low · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5](https://agentprime.io/advisories/CVE-2026-105412.md)
  `CVE-2026-105412` · CVE record: Dassault Systèmes Tuleap Enterprise Edition · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Zen Cart PayPal IPN paypaldp.php zen_db_perform sql injection](https://agentprime.io/advisories/CVE-2026-108826.md)
  `CVE-2026-108826` · CVE record: Zen Cart · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [DataEase Utils.java Utils.buildCalcField sql injection](https://agentprime.io/advisories/CVE-2026-108824.md)
  `CVE-2026-108824` · CVE record: DataEase · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [Tencent WeKnora SQL Validator inject.go validateSubquery sql injection](https://agentprime.io/advisories/CVE-2026-108821.md)
  `CVE-2026-108821` · CVE record: Tencent WeKnora · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [SQL Injection in Clustering Communication (Hybrid Mode)](https://agentprime.io/advisories/CVE-2026-1907.md)
  `CVE-2026-1907` · CVE record: Kong Kong Enterprise Gateway and 1 more · CVSS 7.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [SEMCMS SEMCMS_Banner.php sql injection](https://agentprime.io/advisories/CVE-2026-108814.md)
  `CVE-2026-108814` · CVE record: SEMCMS · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [SEMCMS SEMCMS_Download.php sql injection](https://agentprime.io/advisories/CVE-2026-108813.md)
  `CVE-2026-108813` · CVE record: SEMCMS · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [krupalshah EmployeeRecruitmentSystem Registration adminregister.php mysql_query sql injection](https://agentprime.io/advisories/CVE-2026-108807.md)
  `CVE-2026-108807` · CVE record: krupalshah EmployeeRecruitmentSystem · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [krupalshah EmployeeRecruitmentSystem Forgot Password authprocessing.php mysql_query sql injection](https://agentprime.io/advisories/CVE-2026-108806.md)
  `CVE-2026-108806` · CVE record: krupalshah EmployeeRecruitmentSystem · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [krupalshah EmployeeRecruitmentSystem Login loginprocessing.php mysql_query sql injection](https://agentprime.io/advisories/CVE-2026-108805.md)
  `CVE-2026-108805` · CVE record: krupalshah EmployeeRecruitmentSystem · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [SQL injection in Night Shift bulk license plate search allows cross-organization data access](https://agentprime.io/advisories/CVE-2026-109080.md)
  `CVE-2026-109080` · CVE record: Flock Night Shift · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [jackq XCMS Password Recovery Mail Endpoint PublicController.class.php sendFindPwdMail sql injection](https://agentprime.io/advisories/CVE-2026-108799.md)
  `CVE-2026-108799` · CVE record: jackq XCMS · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection](https://agentprime.io/advisories/CVE-2026-108794.md)
  `CVE-2026-108794` · CVE record: ZKTeco BioTime · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [erzhongxmu JEEWMS Autocomplete CommonServiceImpl.java CommonServiceImpl.getAutoList sql injection](https://agentprime.io/advisories/CVE-2026-108782.md)
  `CVE-2026-108782` · CVE record: erzhongxmu JEEWMS · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [erzhongxmu JEEWMS PDA WmToMoveGoodsController.java WmToMoveGoodsController.list sql injection](https://agentprime.io/advisories/CVE-2026-108781.md)
  `CVE-2026-108781` · CVE record: erzhongxmu JEEWMS · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [erzhongxmu JEEWMS WmSttInGoodsController.java WmSttInGoodsController.list sql injection](https://agentprime.io/advisories/CVE-2026-108779.md)
  `CVE-2026-108779` · CVE record: erzhongxmu JEEWMS · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [erzhongxmu JEEWMS Inbound Quality Check Pda WmInQmIController.java WmInQmIController.list sql injection](https://agentprime.io/advisories/CVE-2026-108778.md)
  `CVE-2026-108778` · CVE record: erzhongxmu JEEWMS · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Other injection, SQL injection
- [erzhongxmu JEEWMS WvGiController.java WvGiController.list sql injection](https://agentprime.io/advisories/CVE-2026-108777.md)
  `CVE-2026-108777` · CVE record: erzhongxmu JEEWMS · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Other injection, SQL injection
- [erzhongxmu JEEWMS Search Endpoint WvNoticeController.java WvNoticeController.list sql injection](https://agentprime.io/advisories/CVE-2026-108775.md)
  `CVE-2026-108775` · CVE record: erzhongxmu JEEWMS · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Other injection, SQL injection
- [erzhongxmu JEEWMS MdBinController.java getbinallagv sql injection](https://agentprime.io/advisories/CVE-2026-108774.md)
  `CVE-2026-108774` · CVE record: erzhongxmu JEEWMS · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Other injection, SQL injection
- [erzhongxmu JEEWMS WmOmNoticeHController.java docheck sql injection](https://agentprime.io/advisories/CVE-2026-108773.md)
  `CVE-2026-108773` · CVE record: erzhongxmu JEEWMS · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Other injection, SQL injection
- [Interuse i-Bos CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')](https://agentprime.io/advisories/CVE-2026-59508.md)
  `CVE-2026-59508` · CVE record: Interuse i-Bos · CVSS 5.9 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: SQL injection
- [erzhongxmu Jeewms Autocomplete Data JeecgFormDemoController.java getTreeData sql injection](https://agentprime.io/advisories/CVE-2026-108684.md)
  `CVE-2026-108684` · CVE record: erzhongxmu Jeewms · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Other injection, SQL injection

Newest: <https://agentprime.io/advisories/tag/sql-injection.md>
Older: <https://agentprime.io/advisories/tag/sql-injection.md?cursor=WyIyMDI2LTEwLTExVDE0OjQ1OjE0Ljc5MjAwMFoiLCJDVkUtMjAyNi0xMDg2ODQiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=sql-injection&cursor=WyIyMDI2LTEwLTEzVDA5OjE5OjAwLjc5MDAwMFoiLCJDVkUtMjAyNi04OTE5NyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/sql-injection/?cursor=WyIyMDI2LTEwLTEzVDA5OjE5OjAwLjc5MDAwMFoiLCJDVkUtMjAyNi04OTE5NyJd>. Everything for agents: <https://agentprime.io/llms.txt>.