CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in topics.php of phpWebSite 0.10.2 and earlier allows remote attackers to execute arbitrary SQL commands via the topic parameter.
SQL injection vulnerability in misc.php in MyBulletinBoard (MyBB) 1.03 (and 1.04) allows remote attackers to execute arbitrary SQL commands by setting the comma variable via the comma parameter in a cookie when register_globals is enabled.
A direct static code injection vulnerability in func.inc.php in freeForum before 1.2.1 allows remote attackers to execute arbitrary PHP code via the X-Forwarded-For and Client-Ip HTTP headers, which are stored in Data/flood.db.php.
The ncprwsnt service in NCP Network Communication Secure Client 8.11 Build 146 (and possibly other versions) allows local users to execute arbitrary code by modifying the connect.bat script, which is automatically executed by the service after a connection is established.
SQL injection vulnerability in vuBB 0.2 allows remote attackers to execute arbitrary SQL commands via the 'pass' parameter in a cookie.
SQL injection vulnerability in yazdir.asp in Cilem Hiber 1.1 allows remote attackers to execute arbitrary SQL commands via the haber_id parameter. This product is also referred to as Cilem News.
A vulnerability in the automount service in Mac OS X 10.4.5 and earlier allows remote file servers to cause a denial of service (unresponsiveness) or execute arbitrary code via unspecified vectors that cause automount to mount file systems with reserved names.
The sondages module in PwsPHP 1.2.3 contains an SQL injection vulnerability. Remote attackers can execute arbitrary SQL commands via the id parameter in requests to index.php.
SQL injection vulnerability in profil.php in PwsPHP 1.2.3 (and earlier versions) allows remote attackers to execute arbitrary SQL commands via the aff_news_form parameter. This is a different vulnerability than CVE-2005-1509.
Archangel Weblog 0.90.02 allows remote attackers to bypass authentication by setting the ba_admin cookie to 1.
ShoutLIVE 1.1.0 contains multiple direct static code injection vulnerabilities in savesettings.php. Remote attackers can write arbitrary PHP code to settings.php via request variables.
A vulnerability in Thomson SpeedTouch modem running firmware 5.3.2.6.0 allows remote attackers to create user accounts that cannot be deleted by the administrator. This is achieved by injecting script code into the '31' parameter of the NewUser function, which is not filtered during account creation but is sanitized in the admin interface, preventing deletion.
SQL injection vulnerability in DCI-Taskeen 1.03 allows remote attackers to execute arbitrary SQL commands via the id or action parameter in basket.php, or id or page parameter in cat.php.
A vulnerability in Bugzilla 2.19.3 through 2.20 improperly handles "//" sequences in URLs when redirecting a user from the login form. This could cause it to generate a partial URL in a form action that leads to sending form data to another domain.
A vulnerability in Bugzilla 2.16.10 involves improper handling of characters in the maxpatchsize and maxattachmentsize parameters in attachment.cgi, allowing a remote attacker to trigger a SQL error.
A buffer overflow vulnerability exists in RITLabs The Bat! 3.60.07 in the email subject field. A remote attacker can exploit this to execute arbitrary code on the victim's system.
SQL injection vulnerability in Oi! Email Marketing System 3.0 allows remote attackers to execute arbitrary SQL commands via the Username and Password fields on the login page.
SQL injection vulnerability in PHP-Nuke before version 7.8 Patched 3.2 allows remote attackers to execute arbitrary SQL commands via encoded /%2a (/*) sequences in the query string, bypassing regular expressions intended to protect against SQL injection, as demonstrated via the kala parameter.
SQL injection vulnerability in D3Jeeb Pro 3 allows remote attackers to execute arbitrary SQL commands via the catid parameter in fastlinks.php and catogary.php.
PHP-Nuke 7.8 Patched 3.2 contains a vulnerability that allows bypassing SQL injection protection. An attacker can use /%2a (/*) sequences with the "ad_click" word in the query string, e.g., via the kala parameter.