CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The DB_eSession library version 1.0.2 and earlier contains an SQL injection vulnerability in the deleteSession() function. Attackers can remotely execute arbitrary SQL commands via the $_sess_id_set variable, which is usually derived from PHPSESSID.
Multiple SQL injection vulnerabilities in XMB Forums 1.9.3 and earlier allow remote attackers to execute arbitrary SQL commands via the $u2u_select array parameter in u2u.inc.php and the $val variable (fidpw0 cookie value) in today.php.
In the guestex.pl script in Guestex 1.0 by Teca Scripts, an unspecified vulnerability allows remote attackers to execute arbitrary shell commands via the email parameter, likely involving shell metacharacters.
BirthSys 3.1 contains an SQL injection vulnerability in show.php, allowing remote attackers to execute arbitrary SQL commands via the $month variable.
An unspecified vulnerability in in.rexecd in Solaris 10 allows local users to gain privileges on Kerberos systems via unknown attack vectors.
SQL injection vulnerability in army.php of the Army System 2.1.0 for Invision Power Board (IPB) allows remote attackers to execute arbitrary SQL commands via the userstat parameter in an army action to index.php.
HiveMail 1.3 and earlier contains multiple eval injection vulnerabilities allowing remote attackers to execute arbitrary PHP code via parameters such as contactgroupid in addressbook.update.php, messageid in addressbook.add.php, folderid in folders.update.php, and other parameters in scripts like calendar.event.php, index.php, pop.download.php, read.bounce.php, rules.block.php, language.php, and others.
HiveMail 1.3 and earlier contain multiple SQL injection vulnerabilities in various scripts, allowing remote attackers to execute arbitrary SQL commands via parameters such as contactgroupid, messageid, folderid, and others. Additionally, authenticated users can exploit similar flaws in index.php and other scripts due to improper handling of $_SERVER['PHP_SELF'].
Multiple unspecified vulnerabilities were found in the FUSE client and NOOFS daemon before version 0.9.0. Their impact and attack vectors are not specified.
Multiple buffer overflows in BomberClone before version 0.11.6.2 allow remote attackers to execute arbitrary code via long error messages.
SQL injection vulnerability in the Your_Account module in PHP-Nuke 7.8 and earlier. An attacker can remotely execute arbitrary SQL commands via the username variable (Nickname field) in index.php.
SQL injection vulnerability in mstrack.php in MusOX DF MSAnalysis (DFMSA), used in some environments with CPG-Nuke Dragonfly CMS, allows remote attackers to trigger path disclosure from a SQL syntax error and possibly execute arbitrary SQL commands via certain query data, likely involving the profile name.
SQL injection vulnerability in functions.php in Teca Diary PE 1.0 allows remote attackers to execute arbitrary SQL commands via the yy, mm, and dd parameters.
SQL injection vulnerability in pmlite.php in RunCMS versions 1.2 and 1.3a. Remote attackers can execute arbitrary SQL commands via the to_userid parameter.
SQL injection vulnerability in search.php of webSPELL 4.01.00 and earlier allows remote attackers to inject arbitrary SQL commands via the title_op parameter.
SQL injection vulnerability in member_login.php in PHP Classifieds 6.18–6.20. Remote attackers can execute arbitrary SQL commands via the username (email field) and password parameters.
In CALimba 0.99.2 beta and earlier, multiple SQL injection vulnerabilities exist in rb_auth.php via the login and password parameters. Remote attackers can execute arbitrary SQL commands and bypass login authentication.
Ansilove before version 1.03 does not filter uploaded file extensions, allowing remote attackers to execute arbitrary code by uploading files with dangerous extensions and then accessing them directly in the upload directory.
A PHP remote file inclusion vulnerability in application.php in nicecoder.com indexu 5.0.0 and 5.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the base_path parameter.
Unspecified vulnerabilities in Zen Cart before version 1.2.7 allow remote attackers to cause unknown impact via unspecified vectors related to other attempted exploits than SQL injection.