CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A SQL injection vulnerability has been discovered in code-projects Real State Services 1.0 in the file /normalHomeRent.php. An attacker can remotely manipulate the loc argument, leading to unauthorized database access. The exploit has been publicly released, increasing the risk of attacks.
A SQL injection vulnerability was found in Real State Services 1.0 in the file /normalHomeSale.php. An attacker can remotely manipulate the 'loc' argument, leading to SQL injection. The exploit is publicly available.
A SQL injection vulnerability was found in Hanwang e-Face General Management Platform 6.3.5.4 in the file /sysAuthStr/querySysAuthStr.do. An attacker can remotely manipulate the order argument, leading to SQL injection. The exploit is publicly available.
A vulnerability was found in Ruijie RG-UAC up to version 1.0-R1.8.2.p5 in the file user_auth_commit.php. An unknown function allows unrestricted file upload via manipulation of the upload_image argument. The attack can be performed remotely and the exploit has been made public.
A SQL injection vulnerability has been found in Smart Parking System 1.0 in the file /parkings/parkings.php. An unknown function allows manipulation of the street/city/status arguments, enabling remote SQL injection. The exploit has been publicly disclosed.
A SQL injection vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0 in the /edit_product.php file via the ID argument. The attack can be performed remotely and the exploit has been published.
A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /edit_coursea.php. An attacker can remotely manipulate the ID argument, leading to SQL injection. The exploit is publicly available.
A SQL injection vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. The issue is in the /edit_exam.php file, where the ID argument is vulnerable to manipulation. The attack can be performed remotely, and the exploit has been publicly disclosed.
A vulnerability in TidGi-Desktop up to version 0.13.0 was found in the Git Repository Import component. An unknown function in loadWikiTiddlersWithSubWikis.ts allows remote code injection. The exploit is public and could be used.
A vulnerability was found in UTT HiPER 1250GW up to version 3.2.7-210907-180535 in the file /goform/ConfigWirelessBase_5g. Manipulation of the ssid argument leads to a stack-based buffer overflow, potentially allowing remote code execution. The exploit has been publicly disclosed.
A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0 in the register.php file. Manipulation of the role argument during registration can lead to improper privilege management. The attack can be performed remotely and the exploit has been published.
A security vulnerability has been discovered in SourceCodester Pizzafy E-Commerce System 1.0, specifically in the file /admin/ajax.php?action=confirm_order. The ID argument is susceptible to SQL injection, allowing remote attacks. The exploit has been publicly released.
A SQL injection vulnerability was found in code-projects Online Examination 1.0 in the head.php file. Manipulating the uname or password arguments allows remote exploitation. The exploit has been publicly disclosed and may be used.
A SQL injection vulnerability has been found in the Internship Management System 1.0 in the employer/login.php file. An attacker can remotely manipulate the email/password arguments, leading to SQL injection. The exploit has been publicly disclosed.
A SQL injection vulnerability was found in the save_client function of classes/Users.php in SourceCodester Multi-Vendor Online Grocery Management System 1.0. Manipulation of the Name argument in the Registration Handler allows remote SQL injection. The exploit has been made public and could be used.
A weakness in SourceCodester Multi-Vendor Online Grocery Management System 1.0 affects the save_users function in classes/Users.php, causing improper authorization. Remote exploitation is possible, and the exploit is publicly available.
A vulnerability in the Crypt::DSA library for Perl before version 1.22 causes insecure generation of DSA signing nonces and private keys due to a biased random generator. An attacker with access to a few signatures and the public key can recover the private key using a lattice attack.
A SQL injection vulnerability was found in itsourcecode Online Hotel Management System 1.0 in the file /admin/login.php. An attacker can remotely manipulate the email argument, leading to SQL injection. The exploit is publicly available.
A SQL injection vulnerability was found in Online Job Portal 1.0 in the login.php file. Manipulating the txtUser or txtPass arguments allows remote execution of unauthorized database queries. The exploit has been published, increasing the attack risk.
A SQL injection vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0 in the file /admin/girlsproductdeletequery.php. An unknown function allows manipulation of the user_id argument, enabling remote SQL injection. The exploit is publicly available and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS