CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A remote file inclusion vulnerability exists in the scormExport.inc.php script of Claroline 1.7.4 and earlier. Attackers can exploit the includePath parameter to execute arbitrary PHP code.
Claroline 1.7.4 and earlier contains directory traversal vulnerabilities in document/rqmkhtml.php. Attackers can read arbitrary files via the file parameter or execute arbitrary code via the includePath parameter.
A direct static code injection vulnerability in QLnews 1.2 allows remote authenticated administrators to execute arbitrary PHP code by modifying config.php.
SQL injection vulnerability in topics.php of Dynamic Bulletin Board System (DbbS) 2.0-alpha and earlier. Remote attackers can execute arbitrary SQL commands via the limite parameter.
SQL injection vulnerability in admin_login.asp of ISP of Egypt SiteMan allows remote attackers to execute arbitrary SQL commands via the pass parameter.
A PHP remote file inclusion vulnerability in index.php of MediaSlash Gallery allows attackers to execute arbitrary PHP code by supplying a malicious URL in the rub parameter (part of the $page_menu variable).
SQL injection vulnerability in PHP Script Index allows remote attackers to execute arbitrary SQL commands via the search parameter. The details are obtained solely from third party information.
A direct static code injection vulnerability in config.php of [V]Book 2.0 allows remote administrators to inject arbitrary PHP code into the configuration file. This code is then included by other [V]Book scripts, leading to arbitrary code execution.
Multiple SQL injection vulnerabilities in SkinTech phpNewsManager 1.48 allow remote attackers to execute arbitrary SQL commands via unspecified parameters, likely id and topicid, in scripts such as browse.php, category.php, gallery.php, poll.php, and possibly others.
Multiple SQL injection vulnerabilities were found in X-Changer 0.2. Remote attackers can execute arbitrary SQL commands via the 'from' and 'into' parameters in a 'calculate' action, and the 'id' parameter in an 'edit' action in index.php.
VSNS Lemon 3.2.0 allows remote attackers to bypass authentication and access password-protected articles by setting the vsns[topic_id] cookie to the targeted topic.
Multiple buffer overflows were found in the xfig import code (xfig-import.c) in Dia versions 0.87 through 0.95-pre6. An attacker can exploit a crafted xfig file with an invalid color index, number of points, or depth, potentially causing unknown impacts.
A vulnerability in Apache Struts before version 1.2.9 with BeanUtils 1.7 allows a remote attacker to cause a denial of service (DoS) by submitting a multipart/form-data encoded form with a parameter name referencing the public getMultipartRequestHandler method. This provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
A vulnerability in Apache Struts before version 1.2.9 allows a remote attacker to bypass validation by adding the 'org.apache.struts.taglib.html.Constants.CANCEL' parameter to a request. This cancels the action but is not detected by applications that do not use the isCancelled check.
SQL injection vulnerability in Default.asp in EzASPSite 2.0 RC3 and earlier allows remote attackers to execute arbitrary SQL commands and obtain the SHA1 hash of the admin password via the Scheme parameter.
Multiple SQL injection vulnerabilities in PhxContacts 0.93.1 beta and earlier allow remote attackers to execute arbitrary SQL commands via the motclef, nbr_line_view, and id_contact parameters. This can lead to unauthorized database access.
A vulnerability in MSO.DLL of Microsoft Office 2000, XP, and 2003 allows user-assisted attackers to cause denial of service or execute arbitrary code via crafted documents. The attack exploits an invalid array index or integer overflow, leading to access violations in various Office components.
Multiple buffer overflows in the checkscores function in scores.c of tetris-bsd in bsd-games before version 2.17-r1 on Gentoo Linux allow local users with games group membership to modify tetris-bsd.scores with crafted executable content, which executes when another user launches tetris-bsd.
SQL injection vulnerability in newsletter.php of Sourceworkshop newsletter 1.0. Remote attackers can execute arbitrary SQL commands via the newsletteremail parameter.
A direct static code injection vulnerability in VNews 1.2 allows remote authenticated administrators to inject PHP code into the admin/config.php file via variables stored in that file. The attacker can then execute arbitrary code on the server.