CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An unspecified vulnerability in Microsoft PowerPoint in Office 2000 SP3, Office XP SP3, Office 2003 SP1 and SP2, Office 2004 for Mac, and v. X for Mac allows user-assisted attackers to execute arbitrary code via a PowerPoint document with a malformed record, which triggers memory corruption.
An integer overflow in the PolyPolygon function of the Graphics Rendering Engine on Microsoft Windows 98 and Me allows remote attackers to execute arbitrary code via a crafted WMF or EMF image. The flaw occurs when the sum of entries in the vertex counts array and the number of polygons triggers a heap-based buffer overflow.
In MyBulletinBoard (MyBB) 1.1.2, the domecode function in inc/functions_post.php allows remote attackers to execute arbitrary PHP code via the username field, which is used in a preg_replace call with the /e (executable) modifier.
Wielokrotne podatności na wstrzykiwanie SQL w Dominios Europa PICRATE (znanym również jako TAL RateMyPic) w wersji 1.0 pozwalają zdalnym atakującym na wykonywanie dowolnych poleceń SQL poprzez parametry (1) id, (2) voteid i (3) vfiel w pliku index.php oraz poprzez parametry (4) nick, (5) email, (6) city, (7) messen i (8) message w formularzu w pliku add.php.
Multiple PHP remote file inclusion vulnerabilities in Enterprise Timesheet and Payroll Systems (EPS) 1.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the absolutepath parameter in footer.php and admin/footer.php.
W podatności CVE-2006-2998 w systemie free QBoard w wersji 1.1 i wcześniejszych, występuje luka umożliwiająca zdalne włączenie pliku PHP w pliku board/post.php. Atakujący mogą wykonać dowolny kod PHP, wykorzystując parametr qb_path z odpowiednim adresem URL.
SQL injection vulnerability in index.php of IntegraMOD 1.4.0 and earlier allows remote attackers to execute arbitrary SQL commands via double-encoded apostrophe characters in the STYLE_URL parameter.
W podatności CVE-2006-2996 występuje luka w pliku inc/design.inc.php w LoveCompass aePartner w wersji 0.8.3 i wcześniejszych, która umożliwia zdalnym atakującym wykonanie dowolnego kodu PHP poprzez URL w parametrze dir[data].
Wielokrotne podatności na zdalne dołączanie plików w PHP w WebprojectDB w wersji 0.1.3 i wcześniejszych umożliwiają zdalnym atakującym wykonanie dowolnego kodu PHP poprzez URL w parametrze INCDIR w plikach (1) include/nav.php oraz (2) include/lang.php.
Wielokrotne podatności na wstrzykiwanie SQL w My Photo Scrapbook 1.0 i wcześniejszych wersjach umożliwiają zdalnym atakującym wykonywanie dowolnych poleceń SQL za pomocą parametru key w plikach Displayview.asp oraz Details_Photo_bv.asp.
PHP remote file inclusion vulnerability in Enterprise Timesheet and Payroll Systems (EPS) 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the absolutepath parameter in cal.php. The details are obtained solely from third party information.
SQL injection vulnerability in vs_search.php of Arantius Vice Stats before version 1.0.1 allows remote attackers to execute arbitrary SQL commands via unknown vectors. This issue is distinct from CVE-2006-2972.
SQL injection vulnerability in block_forum_topic_new.php of ViArt Shop Free 2.5.5 and other distributions (Light, Standard, Enterprise) allows remote attackers to execute arbitrary SQL commands via unknown vectors, likely involving the forum_id parameter.
SQL injection vulnerability in vs_resource.php of Arantius Vice Stats versions 0.5b and 1.0. Remote attackers can execute arbitrary SQL commands via the ID parameter.
SQL injection vulnerability in big.php of Mafia Moblog 0.6M1 and earlier. Remote attackers can execute arbitrary SQL commands via the img parameter.
Unspecified vulnerability in usermgr.php in Coppermine Photo Gallery before version 1.4.7. It may allow remote attacks with unknown impact, possibly related to authorization or authentication errors.
Multiple SQL injection vulnerabilities in month.php of PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the catid and cid parameters.
A remote file inclusion vulnerability in Joomla! 1.0 allows attackers to execute arbitrary PHP code by supplying a URL in the 'includepath' parameter in includes/joomla.php.
SQL injection vulnerability in files.asp in OfficeFlow 2.6 and earlier allows remote attackers to execute arbitrary SQL commands via the Project parameter.
Xtreme Scripts Download Manager 1.0 contains multiple PHP remote file inclusion vulnerabilities. An attacker can execute arbitrary PHP code remotely by supplying a malicious URL in the 'root' parameter in several scripts, including download.php and manager.php.