CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in topic.php in DirectTopics 2.1 and 2.2 allows remote attackers to execute arbitrary SQL commands via the topic parameter.
Multiple SQL injection vulnerabilities in MidiCart PHP Shopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) searchstring parameter to search_list.php, the (2) maingroup or (3) secondgroup parameters to item_list.php, or (4) code_no parameter to item_show.php.
SQL injection vulnerability in profil.php in PwsPHP 1.2.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Vulnerability in MidiCart PHP Shopping Cart allows a remote attacker to obtain sensitive information by directly requesting search_list.php, item_list.php, or item_show.php files. The response includes a PHP error message revealing the system path.
A vulnerability in DMail 3.1a allows a remote attacker to bypass authentication, read log files, and shut down the system by sending a sendlog command with an incorrect password hash, which is not properly handled by the _cmd_sendlog function.
Multiple SQL injection vulnerabilities in MaxWebPortal 1.3.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) fpassword parameter to inc_functions.asp, (2) txtAddress, (3) message, or (4) subject parameter to post_info.asp, (5) andor parameter to search.asp, (6) verkey parameter to pop_profile.asp, or (7) Remove or (8) Delete parameter to pm_delete2.asp.
The SSH module in Neteyes Nexusway allows remote attackers to execute arbitrary commands via shell metacharacters in arguments to certain commands, as demonstrated using ping and traceroute.
SQL injection vulnerability in out.php in CJ Ultra (CJUltra) Plus versions 1.0.3 and 1.0.4 allows remote attackers to execute arbitrary SQL commands via the perm parameter.
An unknown vulnerability in Cisco Firewall Services Module (FWSM) 2.3.1 and earlier, when using URL, FTP, or HTTPS filtering exceptions, allows certain TCP packets to bypass access control lists (ACLs).
The elf_core_dump function in binfmt_elf.c for Linux kernel 2.x.x to 2.2.27-rc2, 2.4.x to 2.4.31-pre1, and 2.6.x to 2.6.12-rc4 allows local users to execute arbitrary code via an ELF binary that, in certain conditions involving the create_elf_tables function, causes a negative length argument to pass a signed integer comparison, leading to a buffer overflow.
The new account wizard in Mail.app 2.0 in Mac OS 10.4, when configuring an IMAP mail account and checking the credentials, does not prompt the user to use SSL until after the password has already been sent, which causes the password to be sent in plaintext.
SQL injection vulnerability in index.php for Quick.cart 0.3.0 allows remote attackers to execute arbitrary SQL commands via the iCategory parameter. The vendor disputes this, claiming Quick.cart does not use SQL and cannot be vulnerable to SQL injection.
In Oracle Database 9i and 10g, after the SYS user executes a SELECT statement on an FGA object, Fine Grained Audit (FGA) is disabled, making it easier for attackers to evade detection.
Multiple SQL injection vulnerabilities in FishCart 3.1 allow remote attackers to execute arbitrary SQL commands via the (1) cartid parameter to upstnt.php or (2) psku parameter to display.php. NOTE: the vendor disputes this report, claiming they are forced SQL errors; the original researcher is known to be unreliable.
Multiple SQL injection vulnerabilities in Quick.Forum 2.1.6 allow remote attackers to execute arbitrary SQL commands via the iCategory or page parameter to index.php, or iCategory parameter in the query string to the forum directory.
Multiple SQL injection vulnerabilities in Aaron Outpost ASP Inline Corporate Calendar allow remote attackers to execute arbitrary SQL commands via the Event_ID parameter to (1) defer.asp or (2) details.asp.
The vulnerability in users.ini.php in BoastMachine 3.0 does not properly restrict file upload types, allowing remote attackers to execute arbitrary code.
The web module in Neteyes Nexusway allows remote attackers to bypass authentication and gain administrator privileges by setting the cyclone500_auth cookie.
Multiple SQL injection vulnerabilities in myBloggie 2.1.1 and 2.1.3 allow remote attackers to execute arbitrary SQL commands via parameters in search.php and index.php.
SQL injection vulnerability in admin_login.asp in ASP Virtual News Manager allows remote attackers to execute arbitrary SQL commands via the password parameter.