CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A PHP remote file inclusion vulnerability in includes/common.php of gnopaste 0.5.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.
SQL injection vulnerability in index.php of Particle Wiki version 1.0.2 and earlier. Remote attackers can execute arbitrary SQL commands via the version parameter.
SQL injection vulnerability in index.php in iBWd Guestbook 1.0 allows remote attackers to execute arbitrary SQL commands via the offset parameter.
PHP remote file inclusion vulnerability in template.php in phpBB 2 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. However, this issue is disputed as template.php does not appear in standard phpBB and does not use a $page variable.
PHP remote file inclusion vulnerability in MyBloggie 2.1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mybloggie_root_path parameter to admin.php or scode.php. This issue has been disputed by multiple third parties, stating that the source code does not demonstrate the issue and scode.php is not part of the distribution.
PHP remote file inclusion vulnerability in config.php in Rumble 1.02 allows remote attackers to execute arbitrary PHP code via a URL in the configArr[pathtodir] parameter.
Unspecified vulnerability in the CHM unpacker in avast! before version 4.7.844. The impact and attack vectors are unknown.
SQL injection vulnerability in viewmsg.asp of LocazoList Classifieds 1.05e allows remote attackers to execute arbitrary SQL commands via the msgid parameter.
A buffer overflow in the web console of F-Secure Anti-Virus for Microsoft Exchange 6.40 and Internet Gatekeeper 6.40 through 6.42 and 6.50 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors. By default, connections are only allowed from the local host.
SQL injection vulnerability in saphplesson 2.0 allows remote attackers to execute arbitrary SQL commands via the forumid parameter in add.php and lessid parameter in show.php.
AssoCIateD (ACID) CMS 1.1.3 has multiple PHP remote file inclusion vulnerabilities. An attacker can execute arbitrary PHP code by supplying a malicious URL in the root_path parameter to menu.php, profile.php, users.php, cache_mngt.php, and gallery_functions.php.
In SquirrelMail 1.4.6 and earlier, with register_globals enabled and magic_quotes_gpc disabled, a remote attacker can inject and execute arbitrary PHP code via the plugins array parameter in plugin.php. Although disputed, the vendor has issued a security advisory.
Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parameter to simple_user/pages/index.inc.php and stats/pages/index.inc.php.
PHP remote file inclusion vulnerability in Redaxo 2.7.4 allows remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parameter in addons/import_export/pages/index.inc.php and pages/community.inc.php.
A PHP remote file inclusion vulnerability in Redaxo versions 3.0 through 3.2 allows remote attackers to execute arbitrary PHP code by supplying a malicious URL in the REX[INCLUDE_PATH] parameter to image_resize/pages/index.inc.php.
SQL injection vulnerability in links.asp in aspWebLinks 2.0 allows remote attackers to execute arbitrary SQL commands via the linkID parameter.
SQL injection vulnerability in editpost.php in CoolForum 0.8.3 beta and earlier allows remote attackers to execute arbitrary SQL commands via the post parameter.
SQL injection vulnerability in viewimage.php in Particle Gallery 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the imageid parameter.
SQL injection vulnerability in content.php of abarcar Realty Portal 5.1.5 allows remote attackers to execute arbitrary SQL commands via the cat parameter.
A PHP remote file inclusion vulnerability in Bytehoard 2.1 Epsilon/Delta allows remote attackers to execute arbitrary PHP code via the bhconfig[bhfilepath] parameter in includes/webdav/server.php.