CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities in phpYellowTM Pro Edition and Lite Edition 5.33 allow remote attackers to execute arbitrary SQL commands via the haystack parameter in search_result.php or the ckey parameter in print_me.php.
Multiple SQL injection vulnerabilities in Absolute Shopping Package Solutions (ASPS) Shopping Cart Professional 2.9d and earlier, and Lite 2.1 and earlier, allow remote attackers to execute arbitrary SQL commands via the srch_product_name parameter in adv_search.asp and the b_search parameter in bsearch.asp.
MailEnable Professional 1.6 and earlier and Enterprise 1.1 and earlier contain multiple unspecified vulnerabilities that allow attackers to cause a denial of service (crash) via invalid IMAP commands.
Multiple buffer overflows in WinEggDropShell remote access trojan (RAT) 1.7 allow remote attackers to execute arbitrary code via a long GET request to the HTTP server, or long USER or PASS commands to the FTP server.
The IKEv1 implementation in Astaro Security Linux before version 6.102 contains a vulnerability that allows a remote attacker to cause a denial of service and potentially execute arbitrary code via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. Due to lack of details in the advisory, it is unclear which of CVE-2005-3666, CVE-2005-3667, or CVE-2005-3668 apply to this issue.
Multiple SQL injection vulnerabilities in Instant Photo Gallery 1 and earlier allow remote attackers to execute arbitrary SQL commands via the cat_id parameter in portfolio.php and the cid parameter in content.php.
SQL injection vulnerability in article.php in Pineapple Technologies Lore 1.5.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Multiple SQL injection vulnerabilities in Tradesoft CMS allow remote attackers to execute arbitrary SQL commands via unspecified attack vectors.
A memory leak vulnerability in the Avaya TN2602AP IP Media Resource 320 circuit pack before vintage 9 firmware allows remote attackers to cause a denial of service (memory consumption) via crafted VoIP packets.
SQL injection vulnerability in WebCalendar 1.0.1 allows remote attackers to execute arbitrary SQL commands via the time_range parameter in edit_report_handler.php.
Unknown vulnerability in the login page for HP Systems Insight Manager (SIM) 4.0 and 4.1, when accessed by Microsoft Internet Explorer with the MS04-025 patch, leads to a denial of service (browser hang). NOTE: although the advisory is vague, this issue does not appear to involve an attacker at all. If not, then this issue is not a vulnerability.
SQL injection vulnerability in the ticket query module in Edgewall Trac 0.9 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the group parameter.
SQL injection vulnerability in type.asp in multiple DUware products including DUamazon 3.1, DUarticle 1.1, DUclassified 4.2, DUdirectory 3.1 and DUdirectory Pro 3.0/3.0 SQL, DUdownload 1.1, DUgallery 3.3, DUnews 1.1, and DUpaypal 3.1/DUpaypal Pro 3.0 allows remote attackers to execute arbitrary SQL commands via the iType parameter.
SQL injection vulnerability in auth.inc.php in PHPX 3.5.9 and earlier allows remote attackers to execute arbitrary SQL commands, bypass authentication, and upload arbitrary PHP code via the username parameter.
SQL injection vulnerability in MXChange before version 0.2.0-pre10 PL492 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Multiple SQL injection vulnerabilities in NetClassifieds Premium Edition 1.0.1, Professional Edition 1.5.1, Standard Edition 1.9.6.3, and Free Edition 1.0.1 allow remote attackers to execute arbitrary SQL commands via the CatID parameter in ViewCat.php and gallery.php, and the ItemNum parameter in ViewItem.php.
Multiple buffer overflows in libUil (libUil.so) in OpenMotif 2.2.3, and possibly other versions, allows attackers to execute arbitrary code via the (1) diag_issue_diagnostic function in UilDiags.c and (2) open_source_file function in UilSrcSrc.c.
SQL injection vulnerability in session.php in DotClear before version 1.2.3. A remote attacker can execute arbitrary SQL commands via the dc_xd parameter in a cookie.
SQL injection vulnerability in Bedeng PSP 1.1 allows remote attackers to execute arbitrary SQL commands via the cwhere parameter in index.php and download.php, or the ckode parameter in baca.php.
SQL injection vulnerability in index.php in N-13 News 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.