# SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter](https://agentprime.io/advisories/CVE-2026-109197.md)
  `CVE-2026-109197` · CVE record: wpdirectorykit WP Directory Kit · CVSS 7.5 High · Not analysed yet · Published 31 Oct 2026 · Tags: SQL injection
- [Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter](https://agentprime.io/advisories/CVE-2026-101325.md)
  `CVE-2026-101325` · CVE record: contrid Newsletters · CVSS 5.3 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: SQL injection
- [WP2LEADS <= 3.5.6 - Authenticated (Subscriber+) SQL Injection via order Parameter](https://agentprime.io/advisories/CVE-2025-9462.md)
  `CVE-2025-9462` · CVE record: tobias_conrad WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden · CVSS 6.5 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: SQL injection
- [FunnelKit Automations <= 3.8.5.2 - Unauthenticated SQL Injection via 'bwfan_cart_id' Parameter](https://agentprime.io/advisories/CVE-2026-119163.md)
  `CVE-2026-119163` · CVE record: teamfunnelkit FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce · CVSS 7.5 High · Not analysed yet · Published 31 Oct 2026 · Tags: SQL injection
- [ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection](https://agentprime.io/advisories/CVE-2026-62849.md)
  `CVE-2026-62849` · CVE record: mqttsnet thinglinks · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [HoneySQL unchecked entity names can lead to SQL injection results](https://agentprime.io/advisories/CVE-2026-61620.md)
  `CVE-2026-61620` · CVE record: seancorfield honeysql · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39732.md)
  `CVE-2026-39732` · CVE record: Ivijan-Stefan Stipic Transliterator · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [Majestic Support <= 1.2.2 - Authenticated (Subscriber+) SQL Injection via 'columns' Parameter](https://agentprime.io/advisories/CVE-2026-115820.md)
  `CVE-2026-115820` · CVE record: ahmadmj Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [37954679 cak-filemanagement-system save_student.php mysqli_query sql injection](https://agentprime.io/advisories/CVE-2026-119619.md)
  `CVE-2026-119619` · CVE record: 37954679 cak-filemanagement-system · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Other injection, SQL injection
- [CoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageList](https://agentprime.io/advisories/CVE-2026-119656.md)
  `CVE-2026-119656` · CVE record: CoreUnion CoreShop · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [CoreShop through 1.5.5 SQL Injection via order Parameter in GetGoodsPageList](https://agentprime.io/advisories/CVE-2026-119655.md)
  `CVE-2026-119655` · CVE record: CoreUnion CoreShop · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [SQL injection in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-111503.md)
  `CVE-2026-111503` · CVE record: Dell OpenManage Enterprise · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [SQL Injection in Protectel](https://agentprime.io/advisories/CVE-2025-68394.md)
  `CVE-2025-68394` · CVE record: ARKETEAM PROTECTELMAJ and 1 more · CVSS 8.4 High · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [SQL Injection in Protectel](https://agentprime.io/advisories/CVE-2025-68393.md)
  `CVE-2025-68393` · CVE record: ARKETEAM PROTECTELMAJ and 1 more · CVSS 8.4 High · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute](https://agentprime.io/advisories/CVE-2026-119562.md)
  `CVE-2026-119562` · CVE record: phpMyAdmin phpMyAdmin · CVSS 2.3 Low · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber](https://agentprime.io/advisories/CVE-2026-119554.md)
  `CVE-2026-119554` · CVE record: Moodle Project moodle · CVSS 6.0 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting](https://agentprime.io/advisories/CVE-2026-119427.md)
  `CVE-2026-119427` · CVE record: phpMyAdmin phpMyAdmin · CVSS 2.3 Low · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation](https://agentprime.io/advisories/CVE-2026-119419.md)
  `CVE-2026-119419` · CVE record: cakephp cakephp · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()](https://agentprime.io/advisories/CVE-2026-119418.md)
  `CVE-2026-119418` · CVE record: cakephp cakephp · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [Apache Fineract: SQL injection vulnerability in Search API](https://agentprime.io/advisories/CVE-2026-64618.md)
  `CVE-2026-64618` · CVE record: Apache Software Foundation Apache Fineract · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints](https://agentprime.io/advisories/CVE-2026-65874.md)
  `CVE-2026-65874` · CVE record: Apache Software Foundation Apache Fineract · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [WP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' Parameter](https://agentprime.io/advisories/CVE-2026-117572.md)
  `CVE-2026-117572` · CVE record: Unknown WP Visitor Statistics (Real Time Traffic) · CVSS 4.1 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [JoomSport <= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-118698.md)
  `CVE-2026-118698` · CVE record: beardev JoomSport – for Sports: Team & League, Football, Hockey & more · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key](https://agentprime.io/advisories/CVE-2026-61654.md)
  `CVE-2026-61654` · CVE record: lightdash lightdash · CVSS 8.3 High · Not analysed yet · Published 29 Oct 2026 · Tags: SQL injection
- [Authenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.0](https://agentprime.io/advisories/CVE-2026-11587.md)
  `CVE-2026-11587` · CVE record: Centreon Centreon · CVSS 7.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: SQL injection
- [WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-61996.md)
  `CVE-2026-61996` · CVE record: favethemes MLS On The Fly · CVSS 8.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: SQL injection
- [WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39736.md)
  `CVE-2026-39736` · CVE record: Crocoblock JetEngine · CVSS 8.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: SQL injection
- [OpenEMR Before 8.5.0 SQL Injection via form_icd_codes\[\]](https://agentprime.io/advisories/CVE-2026-49142.md)
  `CVE-2026-49142` · CVE record: openemr openemr · CVSS 8.7 High · Not analysed yet · Published 29 Oct 2026 · Tags: SQL injection
- [Newsmatic <= 1.5.0 - Unauthenticated SQL Injection via 'slug' Parameter](https://agentprime.io/advisories/CVE-2026-110184.md)
  `CVE-2026-110184` · CVE record: blazethemes Newsmatic · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: SQL injection
- [WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-115964.md)
  `CVE-2026-115964` · CVE record: StylemixThemes Motors · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: SQL injection
- [WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-115965.md)
  `CVE-2026-115965` · CVE record: BuddyPress BuddyPress · CVSS 8.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: SQL injection
- [JoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-118192.md)
  `CVE-2026-118192` · CVE record: beardev JoomSport – for Sports: Team & League, Football, Hockey & more · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: SQL injection
- [SQL Injection Vulnerability in Radius Xenia M2M Platform](https://agentprime.io/advisories/CVE-2026-114358.md)
  `CVE-2026-114358` · CVE record: Radius Synergies Radius Xenia M2M Platform · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: SQL injection
- [vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter](https://agentprime.io/advisories/CVE-2026-89216.md)
  `CVE-2026-89216` · CVE record: Unknown vTables · CVSS 8.6 High · Not analysed yet · Published 29 Oct 2026 · Tags: SQL injection
- [Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameter](https://agentprime.io/advisories/CVE-2026-93904.md)
  `CVE-2026-93904` · CVE record: dejanmarkovic Social Web Suite – Social Media Auto Post, Social Media Auto Publish · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: SQL injection
- [SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter](https://agentprime.io/advisories/CVE-2026-93855.md)
  `CVE-2026-93855` · CVE record: brewlabs SendPress Newsletters · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: SQL injection
- [AVideo-Encoder: pre-authentication streamer-login SQL injection](https://agentprime.io/advisories/CVE-2026-61569.md)
  `CVE-2026-61569` · CVE record: WWBN AVideo-Encoder · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [OpenCATS: Authenticated SQL injection in activity DataGrid date filters](https://agentprime.io/advisories/CVE-2026-54455.md)
  `CVE-2026-54455` · CVE record: opencats OpenCATS · CVSS 7.6 High · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection, CWE-20
- [WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-115603.md)
  `CVE-2026-115603` · CVE record: Advanced Ads GmbH Advanced Ads – Tracking · CVSS 8.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-111850.md)
  `CVE-2026-111850` · CVE record: BuddyPress BuddyPress · CVSS 8.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-111411.md)
  `CVE-2026-111411` · CVE record: Aman FunnelKit Automations · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-115607.md)
  `CVE-2026-115607` · CVE record: Crowd Favorite DXP ToolKit · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [SQL injection in Dell PowerProtect Data Domain Management Center](https://agentprime.io/advisories/CVE-2026-103792.md)
  `CVE-2026-103792` · CVE record: Dell PowerProtect Data Domain Management Center · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [SQL injection in Dell PowerProtect Data Domain Management Center](https://agentprime.io/advisories/CVE-2026-86386.md)
  `CVE-2026-86386` · CVE record: Dell PowerProtect Data Domain Management Center · CVSS 4.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [SQL injection (SQLi) in the user authentication module of Futurum Software](https://agentprime.io/advisories/CVE-2026-14571.md)
  `CVE-2026-14571` · CVE record: Futurum Software Futurum Software User Authentication Module · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [SQL injection in Dell PowerProtect Data Domain Management Center](https://agentprime.io/advisories/CVE-2026-86401.md)
  `CVE-2026-86401` · CVE record: Dell PowerProtect Data Domain Management Center · CVSS 2.7 Low · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [SQL injection in Dell PowerProtect Data Domain Management Center](https://agentprime.io/advisories/CVE-2026-90719.md)
  `CVE-2026-90719` · CVE record: Dell PowerProtect Data Domain Management Center · CVSS 2.7 Low · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [SQL injection in Dell PowerProtect Data Domain Management Center](https://agentprime.io/advisories/CVE-2026-90723.md)
  `CVE-2026-90723` · CVE record: Dell PowerProtect Data Domain Management Center · CVSS 2.7 Low · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [SQL injection in Dell PowerProtect Data Domain Management Center](https://agentprime.io/advisories/CVE-2026-90724.md)
  `CVE-2026-90724` · CVE record: Dell PowerProtect Data Domain Management Center · CVSS 2.7 Low · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [WP Inventory Manager <= 2.5.5 - Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-76005.md)
  `CVE-2026-76005` · CVE record: chuck1982 WP Inventory Manager · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) SQL Injection via 'catid' Block Attribute](https://agentprime.io/advisories/CVE-2026-116750.md)
  `CVE-2026-116750` · CVE record: e4jvikwp VikRentCar Car Rental Management System · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [WP Visitor Statistics (Real Time Traffic) <= 8.8 - Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-116609.md)
  `CVE-2026-116609` · CVE record: osamaesh WP Visitor Statistics (Real Time Traffic) · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute](https://agentprime.io/advisories/CVE-2026-115281.md)
  `CVE-2026-115281` · CVE record: Unknown Recipe Card Blocks Lite · CVSS 6.8 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [Smart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding](https://agentprime.io/advisories/CVE-2026-115224.md)
  `CVE-2026-115224` · CVE record: Unknown Customer Engagement System · CVSS 4.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [Welcart e-Commerce < 2.12.6 - Editor+ SQLi via 'log_id' Parameter](https://agentprime.io/advisories/CVE-2026-111027.md)
  `CVE-2026-111027` · CVE record: Unknown Welcart e-Commerce · CVSS 6.8 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [Thrive Automator < 11.2 - Editor+ Blind SQLi via 'additional' Parameter](https://agentprime.io/advisories/CVE-2026-104694.md)
  `CVE-2026-104694` · CVE record: Unknown Thrive Automator · CVSS 6.8 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name](https://agentprime.io/advisories/CVE-2026-118378.md)
  `CVE-2026-118378` · CVE record: TabularisDB tabularis · CVSS 8.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field](https://agentprime.io/advisories/CVE-2026-57190.md)
  `CVE-2026-57190` · CVE record: asterisk asterisk and 1 more · CVSS 7.0 High · Not analysed yet · Published 27 Oct 2026 · Tags: SQL injection
- [Tanium addressed a SQL injection vulnerability in Provision.](https://agentprime.io/advisories/CVE-2026-87085.md)
  `CVE-2026-87085` · CVE record: Tanium Provision · CVSS 6.5 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: SQL injection
- [Tanium addressed a SQL injection vulnerability in Patch.](https://agentprime.io/advisories/CVE-2026-108308.md)
  `CVE-2026-108308` · CVE record: Tanium Patch · CVSS 6.5 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: SQL injection

Newest: <https://agentprime.io/advisories/tag/sql-injection.md>
Older: <https://agentprime.io/advisories/tag/sql-injection.md?cursor=WyIyMDI2LTEwLTI3VDE3OjMwOjUzLjM5NjAwMFoiLCJDVkUtMjAyNi0xMDgzMDgiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=sql-injection&cursor=WyIyMDI2LTEwLTMxVDExOjI4OjQzLjgzNjAwMFoiLCJDVkUtMjAyNi0xNTI3MiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/sql-injection/?cursor=WyIyMDI2LTEwLTMxVDExOjI4OjQzLjgzNjAwMFoiLCJDVkUtMjAyNi0xNTI3MiJd>. Everything for agents: <https://agentprime.io/llms.txt>.