# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [oretnom23 php-travel-agency-system Contact Form contact_insert.php sql injection](https://agentprime.io/advisories/CVE-2026-117516.md) `CVE-2026-117516` · CVE record: oretnom23 php-travel-agency-system · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Other injection, SQL injection - [oretnom23 php-travel-agency-system traceapplication.php sql injection](https://agentprime.io/advisories/CVE-2026-117515.md) `CVE-2026-117515` · CVE record: oretnom23 php-travel-agency-system · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Other injection, SQL injection - [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-105489.md) `CVE-2026-105489` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: SQL injection - [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-105781.md) `CVE-2026-105781` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: SQL injection - [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-104354.md) `CVE-2026-104354` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: SQL injection - [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-105779.md) `CVE-2026-105779` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: SQL injection - [oretnom23 php-travel-agency-system Admin Record Pages customer_detail.php sql injection](https://agentprime.io/advisories/CVE-2026-117514.md) `CVE-2026-117514` · CVE record: oretnom23 php-travel-agency-system · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Other injection, SQL injection - [oretnom23 php-travel-agency-system Admin Search Pages customer_search.php sql injection](https://agentprime.io/advisories/CVE-2026-117513.md) `CVE-2026-117513` · CVE record: oretnom23 php-travel-agency-system · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Other injection, SQL injection - [SQL injection in Veeam Backup for Microsoft 365](https://agentprime.io/advisories/CVE-2026-106076.md) `CVE-2026-106076` · CVE record: Veeam Backup for Microsoft 365 · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: SQL injection - [Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter](https://agentprime.io/advisories/GHSA-v5fq-cf5m-vwv7.md) `GHSA-v5fq-cf5m-vwv7`, `CVE-2026-33944`, `PKSA-w1dm-r75t-7cq5` · Packagist `dolibarr/dolibarr`: affected `<22.0.5 || >=23.0.0, <23.0.2`, fixed in `22.0.5`, `23.0.2` · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: SQL injection - [SQL injection in NVIDIA NeMo Agent Toolkit](https://agentprime.io/advisories/CVE-2026-65151.md) `CVE-2026-65151` · CVE record: NVIDIA NeMo Agent Toolkit · CVSS 8.4 High · Not analysed yet · Published 27 Oct 2026 · Tags: SQL injection - [Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2](https://agentprime.io/advisories/CVE-2026-102788.md) `CVE-2026-102788` · CVE record: balbooa.com Gridbox extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: SQL injection - [YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand](https://agentprime.io/advisories/CVE-2026-116828.md) `CVE-2026-116828` · CVE record: YesWiki yeswiki · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: SQL injection - [YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames](https://agentprime.io/advisories/CVE-2026-116821.md) `CVE-2026-116821` · CVE record: YesWiki yeswiki · CVSS 7.1 High · Not analysed yet · Published 26 Oct 2026 · Tags: SQL injection - [OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket](https://agentprime.io/advisories/CVE-2026-116818.md) `CVE-2026-116818` · CVE record: Openpanel-dev openpanel · CVSS 8.8 High · Not analysed yet · Published 26 Oct 2026 · Tags: SQL injection - [OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts](https://agentprime.io/advisories/CVE-2026-116813.md) `CVE-2026-116813` · CVE record: Openpanel-dev openpanel · CVSS 7.1 High · Not analysed yet · Published 26 Oct 2026 · Tags: SQL injection - [OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter](https://agentprime.io/advisories/CVE-2026-116812.md) `CVE-2026-116812` · CVE record: Openpanel-dev openpanel · CVSS 7.1 High · Not analysed yet · Published 26 Oct 2026 · Tags: SQL injection - [OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values](https://agentprime.io/advisories/CVE-2026-116808.md) `CVE-2026-116808` · CVE record: Openpanel-dev openpanel · CVSS 8.6 High · Not analysed yet · Published 26 Oct 2026 · Tags: SQL injection - [OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query](https://agentprime.io/advisories/CVE-2026-116807.md) `CVE-2026-116807` · CVE record: Openpanel-dev openpanel · CVSS 7.0 High · Not analysed yet · Published 26 Oct 2026 · Tags: SQL injection - [itsourcecode Online Book Store book.php sql injection](https://agentprime.io/advisories/CVE-2026-116515.md) `CVE-2026-116515` · CVE record: itsourcecode Online Book Store · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection, SQL injection - [BUG-000187511 - ArcGIS Server has a security vulnerability.](https://agentprime.io/advisories/CVE-2026-10757.md) `CVE-2026-10757` · CVE record: Esri ArcGIS Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: SQL injection - [SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha](https://agentprime.io/advisories/CVE-2026-115418.md) `CVE-2026-115418` · CVE record: AWS aws-cdk/aws-redshift-alpha · CVSS 7.0 High · Not analysed yet · Published 26 Oct 2026 · Tags: SQL injection - [Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store](https://agentprime.io/advisories/CVE-2026-110733.md) `CVE-2026-110733` · CVE record: Apache Software Foundation Apache SIS · CVSS 5.4 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: SQL injection - [Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field](https://agentprime.io/advisories/CVE-2026-116218.md) `CVE-2026-116218` · CVE record: Dolibarr dolibarr · CVSS 7.2 High · Not analysed yet · Published 26 Oct 2026 · Tags: SQL injection - [An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}).](https://agentprime.io/advisories/CVE-2026-115192.md) `CVE-2026-115192` · CVE record · CVSS 7.1 High · Not analysed yet · Published 26 Oct 2026 · Tags: SQL injection - [A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax).](https://agentprime.io/advisories/CVE-2026-115191.md) `CVE-2026-115191` · CVE record · CVSS 7.1 High · Not analysed yet · Published 26 Oct 2026 · Tags: SQL injection - [WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-115608.md) `CVE-2026-115608` · CVE record: Crocoblock JetEngine · CVSS 8.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: SQL injection - [WordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-115948.md) `CVE-2026-115948` · CVE record: David Lingren Media LIbrary Assistant · CVSS 8.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: SQL injection - [HashenUdara edoc-doctor-appointment-system add-new.php sql injection](https://agentprime.io/advisories/CVE-2026-116112.md) `CVE-2026-116112` · CVE record: HashenUdara edoc-doctor-appointment-system · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Cake Ordering System deletetransac.php sql injection](https://agentprime.io/advisories/CVE-2026-116101.md) `CVE-2026-116101` · CVE record: itsourcecode Online Cake Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection, SQL injection - [SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbitrary code via the Login Page](https://agentprime.io/advisories/CVE-2026-31158.md) `CVE-2026-31158` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: SQL injection - [SourceCodester Performance Indicator System save_profile.php sql injection](https://agentprime.io/advisories/CVE-2026-116062.md) `CVE-2026-116062` · CVE record: SourceCodester Performance Indicator System · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Performance Indicator System edit_dealer.php sql injection](https://agentprime.io/advisories/CVE-2026-116061.md) `CVE-2026-116061` · CVE record: SourceCodester Performance Indicator System · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Performance Indicator System adddealer.php sql injection](https://agentprime.io/advisories/CVE-2026-116060.md) `CVE-2026-116060` · CVE record: SourceCodester Performance Indicator System · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Other injection, SQL injection - [SourceCodester Performance Indicator System deleteproduct.php sql injection](https://agentprime.io/advisories/CVE-2026-116055.md) `CVE-2026-116055` · CVE record: SourceCodester Performance Indicator System · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Other injection, SQL injection - [YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create](https://agentprime.io/advisories/CVE-2026-116211.md) `CVE-2026-116211` · CVE record: YesWiki yeswiki · CVSS 8.8 High · Not analysed yet · Published 25 Oct 2026 · Tags: SQL injection - [YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API](https://agentprime.io/advisories/CVE-2026-116207.md) `CVE-2026-116207` · CVE record: YesWiki yeswiki · CVSS 8.8 High · Not analysed yet · Published 25 Oct 2026 · Tags: SQL injection - [SiYuan before v3.8.7 SQL Injection via History Search op and query](https://agentprime.io/advisories/CVE-2026-116170.md) `CVE-2026-116170` · CVE record: siyuan-note siyuan · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: SQL injection - [krupalshah Employee Recruitment System Registration registerform3.php sql injection](https://agentprime.io/advisories/CVE-2026-116050.md) `CVE-2026-116050` · CVE record: krupalshah Employee Recruitment System · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Other injection, SQL injection - [krupalshah EmployeeRecruitmentSystem Registration Wizard registerform2.php mysql_query sql injection](https://agentprime.io/advisories/CVE-2026-116049.md) `CVE-2026-116049` · CVE record: krupalshah EmployeeRecruitmentSystem · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Other injection, SQL injection - [krupalshah EmployeeRecruitmentSystem Registration registerform1.php mysql_query sql injection](https://agentprime.io/advisories/CVE-2026-116048.md) `CVE-2026-116048` · CVE record: krupalshah EmployeeRecruitmentSystem · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Other injection, SQL injection - [mansi-k Restaurant_IMS lsmodal.php mysqli_connect sql injection](https://agentprime.io/advisories/CVE-2026-115999.md) `CVE-2026-115999` · CVE record: mansi-k Restaurant_IMS · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Other injection, SQL injection - [pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection](https://agentprime.io/advisories/CVE-2026-115997.md) `CVE-2026-115997` · CVE record: pig-mesh pig · CVSS 5.3 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Other injection, SQL injection - [WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112866.md) `CVE-2026-112866` · CVE record: WPFactory Product Filter by WBW · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: SQL injection - [WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-111402.md) `CVE-2026-111402` · CVE record: Tribulant Software Newsletters · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: SQL injection - [Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368)](https://agentprime.io/advisories/CVE-2026-46531.md) `CVE-2026-46531` · CVE record: Cacti cacti · CVSS 5.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: SQL injection - [Goobi viewer: Solr injection via unvalidated region parameter in spatial search](https://agentprime.io/advisories/CVE-2026-55465.md) `CVE-2026-55465` · CVE record: intranda goobi-viewer-core · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: SQL injection, Other injection - [Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters](https://agentprime.io/advisories/CVE-2026-55444.md) `CVE-2026-55444` · CVE record: intranda goobi-viewer-core · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: SQL injection, Other injection, CWE-20 - [baserCMS: SQL injection in the admin panel and admin API](https://agentprime.io/advisories/CVE-2026-114621.md) `CVE-2026-114621` · CVE record: baserproject basercms · CVSS 8.8 High · Not analysed yet · Published 23 Oct 2026 · Tags: SQL injection - [WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112860.md) `CVE-2026-112860` · CVE record: xnau webdesign Participants Database · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: SQL injection - [WordPress GamiPress plugin <= 8.0.7 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112837.md) `CVE-2026-112837` · CVE record: Ruben Garcia GamiPress · CVSS 8.5 High · Not analysed yet · Published 23 Oct 2026 · Tags: SQL injection - [Security Advisory 0199](https://agentprime.io/advisories/CVE-2026-114625.md) `CVE-2026-114625` · CVE record: Arista Networks VeloCloud Orchestrator · CVSS 9.4 Critical · Critical (KEV, CVSS 9+) · In CISA KEV · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection - [Unauthenticated SQL Injection Vulnerability in the PAPI Protocol of AOS-8](https://agentprime.io/advisories/CVE-2026-79858.md) `CVE-2026-79858` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection - [Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10](https://agentprime.io/advisories/CVE-2026-79854.md) `CVE-2026-79854` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection - [Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface](https://agentprime.io/advisories/CVE-2026-79852.md) `CVE-2026-79852` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection - [Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8](https://agentprime.io/advisories/CVE-2026-79849.md) `CVE-2026-79849` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection - [Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8](https://agentprime.io/advisories/CVE-2026-79848.md) `CVE-2026-79848` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection - [mem0ai Databricks vector store vulnerable to SQL injection](https://agentprime.io/advisories/GHSA-7587-9684-52r6.md) `GHSA-7587-9684-52r6`, `CVE-2026-115324` · PyPI `mem0ai`: affected `>=0.1.117, <1.0.8`, fixed in `1.0.8` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection - [WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112822.md) `CVE-2026-112822` · CVE record: AmentoTech Workreap Core · CVSS 8.5 High · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection - [Lotus through 0.10.2 SQL Injection via Subscription Filter Keys](https://agentprime.io/advisories/CVE-2026-115332.md) `CVE-2026-115332` · CVE record: uselotus lotus · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .