# SQL injection. Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters](https://agentprime.io/advisories/CVE-2026-115331.md) `CVE-2026-115331` · CVE record: uselotus lotus · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection - [Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics](https://agentprime.io/advisories/CVE-2026-115330.md) `CVE-2026-115330` · CVE record: uselotus lotus · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection - [JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead API](https://agentprime.io/advisories/CVE-2026-115328.md) `CVE-2026-115328` · CVE record: riclolsen json-scada · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection - [Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list](https://agentprime.io/advisories/CVE-2025-71434.md) `CVE-2025-71434` · CVE record: Weaver Network Co., Ltd. E-cology · CVSS 8.8 High · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection - [i-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.php](https://agentprime.io/advisories/CVE-2024-58393.md) `CVE-2024-58393` · CVE record: i-Netsolution Readymade Unilevel Ecommerce MLM · CVSS 8.8 High · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection - [PHPOK < 5.4.081 SQL Injection via api.php sort Parameter](https://agentprime.io/advisories/CVE-2022-51023.md) `CVE-2022-51023` · CVE record: PHPOK PHPOK · CVSS 8.8 High · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection - [NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpoint](https://agentprime.io/advisories/CVE-2022-51021.md) `CVE-2022-51021` · CVE record: WPDeveloper NotificationX · CVSS 8.8 High · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection - [SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter](https://agentprime.io/advisories/CVE-2019-25778.md) `CVE-2019-25778` · CVE record: SeaCMS SeaCMS · CVSS 8.8 High · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection - [WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112327.md) `CVE-2026-112327` · CVE record: TMS Amelia · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection - [oretnom23 php-travel-agency-system Insertion insert.php sql injection](https://agentprime.io/advisories/CVE-2026-114577.md) `CVE-2026-114577` · CVE record: oretnom23 php-travel-agency-system · CVSS 6.9 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Other injection, SQL injection - [Frappe before 16.33.0 Blind SQL Injection via get_events](https://agentprime.io/advisories/CVE-2026-114664.md) `CVE-2026-114664` · CVE record: frappe frappe · CVSS 7.1 High · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection - [amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134](https://agentprime.io/advisories/CVE-2026-87936.md) `CVE-2026-87936` · CVE record: Drupal amazee.ai Private AI Provider · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection - [CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136](https://agentprime.io/advisories/CVE-2026-87938.md) `CVE-2026-87938` · CVE record: Drupal CSP log · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection - [oretnom23 php-travel-agency-system update.php sql injection](https://agentprime.io/advisories/CVE-2026-114441.md) `CVE-2026-114441` · CVE record: oretnom23 php-travel-agency-system · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [oretnom23 php-travel-agency-system delete.php sql injection](https://agentprime.io/advisories/CVE-2026-114440.md) `CVE-2026-114440` · CVE record: oretnom23 php-travel-agency-system · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Cake Ordering System transactionsave.php sql injection](https://agentprime.io/advisories/CVE-2026-114384.md) `CVE-2026-114384` · CVE record: itsourcecode Online Cake Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Cake Ordering System orderdetail.php sql injection](https://agentprime.io/advisories/CVE-2026-114381.md) `CVE-2026-114381` · CVE record: itsourcecode Online Cake Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Cake Ordering System inserttrans.php sql injection](https://agentprime.io/advisories/CVE-2026-114380.md) `CVE-2026-114380` · CVE record: itsourcecode Online Cake Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Cake Ordering System deleteproduct.php sql injection](https://agentprime.io/advisories/CVE-2026-114378.md) `CVE-2026-114378` · CVE record: itsourcecode Online Cake Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [ProjectWorlds Advanced Library Management System profile.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-114266.md) `CVE-2026-114266` · CVE record: ProjectWorlds Advanced Library Management System · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [ProjectWorlds Advanced Library Management System Search Form returned_book_search.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-114265.md) `CVE-2026-114265` · CVE record: ProjectWorlds Advanced Library Management System · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [ProjectWorlds Advanced Library Management System edit_member.php sql injection](https://agentprime.io/advisories/CVE-2026-114264.md) `CVE-2026-114264` · CVE record: ProjectWorlds Advanced Library Management System · CVSS 5.1 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [ProjectWorlds Advanced Library Management System individual_report_search.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-114263.md) `CVE-2026-114263` · CVE record: ProjectWorlds Advanced Library Management System · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [oretnom23 file-management-system-php File Management files.php sql injection](https://agentprime.io/advisories/CVE-2026-114258.md) `CVE-2026-114258` · CVE record: oretnom23 file-management-system-php · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [Cisco Unified Communications Products Hardening Release: October 2026 - Injection Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76477.md) `CVE-2026-76477` · CVE record: Cisco Cisco Emergency Responder and 3 more · CVSS 8.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: SQL injection - [oretnom23 file-management-system-php File Download download.php readfile sql injection](https://agentprime.io/advisories/CVE-2026-114257.md) `CVE-2026-114257` · CVE record: oretnom23 file-management-system-php · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [oretnom23 file-management-system-php Folder Management admin_class.php save_files sql injection](https://agentprime.io/advisories/CVE-2026-114256.md) `CVE-2026-114256` · CVE record: oretnom23 file-management-system-php · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [oretnom23 file-management-system-php User Account Management admin_class.php save_user sql injection](https://agentprime.io/advisories/CVE-2026-114255.md) `CVE-2026-114255` · CVE record: oretnom23 file-management-system-php · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [oretnom23 file-management-system-php admin_class.php login sql injection](https://agentprime.io/advisories/CVE-2026-114254.md) `CVE-2026-114254` · CVE record: oretnom23 file-management-system-php · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales-and-Inventory-System cust_searchfrm.php sql injection](https://agentprime.io/advisories/CVE-2026-114252.md) `CVE-2026-114252` · CVE record: itsourcecode Sales-and-Inventory-System · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales-and-Inventory-System cust_del.php sql injection](https://agentprime.io/advisories/CVE-2026-114251.md) `CVE-2026-114251` · CVE record: itsourcecode Sales-and-Inventory-System · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Sales-and-Inventory-System cust_edit.php sql injection](https://agentprime.io/advisories/CVE-2026-114250.md) `CVE-2026-114250` · CVE record: itsourcecode Sales-and-Inventory-System · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-111852.md) `CVE-2026-111852` · CVE record: WPdreams Ajax Search Lite · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: SQL injection - [dhikshitha29 Insurance-Management-System EditPolicyHolder.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-114243.md) `CVE-2026-114243` · CVE record: dhikshitha29 Insurance-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [dhikshitha29 Insurance-Management-System editPlan.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-114242.md) `CVE-2026-114242` · CVE record: dhikshitha29 Insurance-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [Click n Chat 1.0.4 - 1.1.2 - Unauthenticated SQLi via 'sort_by'/'sort_order' Parameters](https://agentprime.io/advisories/CVE-2026-92998.md) `CVE-2026-92998` · CVE record: Unknown Click n Chat (Chat Widget Integration) · CVSS 8.6 High · Not analysed yet · Published 21 Oct 2026 · Tags: SQL injection - [Click n Chat < 1.1.3 - Unauthenticated SQLi via 'datacolumn' Parameter](https://agentprime.io/advisories/CVE-2026-92997.md) `CVE-2026-92997` · CVE record: Unknown Click n Chat (Chat Widget Integration) · CVSS 8.6 High · Not analysed yet · Published 21 Oct 2026 · Tags: SQL injection - [Swift Performance Lite < 2.3.7.4 - Author+ SQLi via Image Optimizer](https://agentprime.io/advisories/CVE-2026-110651.md) `CVE-2026-110651` · CVE record: Unknown Swift Performance Lite · CVSS 6.8 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: SQL injection - [Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action](https://agentprime.io/advisories/CVE-2026-102499.md) `CVE-2026-102499` · CVE record: Unknown Modern Events Calendar Lite and 1 more · CVSS 7.7 High · Not analysed yet · Published 21 Oct 2026 · Tags: SQL injection - [projectworlds Advanced Library Management System report_search.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-114039.md) `CVE-2026-114039` · CVE record: projectworlds Advanced Library Management System · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Cake Ordering System deletecustomer.php sql injection](https://agentprime.io/advisories/CVE-2026-113740.md) `CVE-2026-113740` · CVE record: itsourcecode Online Cake Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection, SQL injection - [Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API](https://agentprime.io/advisories/CVE-2026-114084.md) `CVE-2026-114084` · CVE record: triggerdotdev trigger.dev · CVSS 8.3 High · Not analysed yet · Published 21 Oct 2026 · Tags: SQL injection - [Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders](https://agentprime.io/advisories/CVE-2026-114065.md) `CVE-2026-114065` · CVE record: triggerdotdev trigger.dev · CVSS 7.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: SQL injection - [Missing authentication in Oracle Corporation Oracle Product Lifecycle Analytics](https://agentprime.io/advisories/CVE-2026-101469.md) `CVE-2026-101469` · CVE record: Oracle Corporation Oracle Product Lifecycle Analytics · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: SQL injection, Privilege escalation, Authentication bypass - [FooSun DotNetCMS 1.0 / 2.0 SQL Injection via City_ajax.aspx](https://agentprime.io/advisories/CVE-2015-20128.md) `CVE-2015-20128` · CVE record: FooSun DotNetCMS · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: SQL injection - [Configurable Reports block for Moodle before 5.3.1 SQL Injection via filter_var](https://agentprime.io/advisories/CVE-2026-113608.md) `CVE-2026-113608` · CVE record: jleyva moodle-block_configurablereports · CVSS 6.0 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: SQL injection - [Apache Cocoon: SQL Injection](https://agentprime.io/advisories/CVE-2026-108087.md) `CVE-2026-108087` · CVE record: Apache Software Foundation Apache Cocoon · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: SQL injection - [Osclass Item Model Item.php findUserItems sql injection](https://agentprime.io/advisories/CVE-2026-113381.md) `CVE-2026-113381` · CVE record: Osclass · CVSS 6.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Other injection, SQL injection - [TYPO3-EXT-SA-2026-029: SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)](https://agentprime.io/advisories/PKSA-s32p-q272-ns98.md) `PKSA-s32p-q272-ns98`, `CVE-2026-112064` · Packagist `sgalinski/sg-cookie-optin`: affected `<7.4.6 || >=8.0.0, <8.1.12`, fixed in `7.4.6`, `8.1.12` · CVSS 7.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: SQL injection - [TYPO3-EXT-SA-2026-034: SQL Injection in extension "File manager" (ameos_filemanager)](https://agentprime.io/advisories/PKSA-jx7x-rkr7-n2tb.md) `PKSA-jx7x-rkr7-n2tb`, `CVE-2026-112238` · Packagist `ameos/ameos_filemanager`: affected `<3.1.3`, fixed in `3.1.3` · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: SQL injection - [YS-infoware｜BA-Workflow - SQL Injection](https://agentprime.io/advisories/CVE-2026-113407.md) `CVE-2026-113407` · CVE record: YS-infoware BA-Workflow · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: SQL injection - [YS-infoware｜BA-Workflow - SQL Injection](https://agentprime.io/advisories/CVE-2026-113406.md) `CVE-2026-113406` · CVE record: YS-infoware BA-Workflow · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: SQL injection - [YS-infoware｜BA-Workflow - SQL Injection](https://agentprime.io/advisories/CVE-2026-113405.md) `CVE-2026-113405` · CVE record: YS-infoware BA-Workflow · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: SQL injection - [EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter](https://agentprime.io/advisories/CVE-2026-93300.md) `CVE-2026-93300` · CVE record: EventOn EventON - Subscriber · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: SQL injection - [Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System ws.asmx xp_cmdshell sql injection](https://agentprime.io/advisories/CVE-2026-112252.md) `CVE-2026-112252` · CVE record: Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, SQL injection - [vraj404 Criminal-Management-System Officer Registration Form addOfficer.php mysqli_error sql injection](https://agentprime.io/advisories/CVE-2026-112153.md) `CVE-2026-112153` · CVE record: vraj404 Criminal-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, SQL injection - [NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields](https://agentprime.io/advisories/CVE-2026-112306.md) `CVE-2026-112306` · CVE record: nocobase nocobase · CVSS 8.6 High · Not analysed yet · Published 19 Oct 2026 · Tags: SQL injection - [vraj404 Criminal-Management-System Search searchOff.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-112152.md) `CVE-2026-112152` · CVE record: vraj404 Criminal-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, SQL injection - [vraj404 Criminal Management System Submission Form home.php sql injection](https://agentprime.io/advisories/CVE-2026-112151.md) `CVE-2026-112151` · CVE record: vraj404 Criminal Management System · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, SQL injection - [vraj404 Criminal-Management-System search.php sql injection](https://agentprime.io/advisories/CVE-2026-112150.md) `CVE-2026-112150` · CVE record: vraj404 Criminal-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .