CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Version 2.1.2 of the mp4v2 library was discovered to contain a memory leak in the MP4BytesProperty class.
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_user.
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via the 'id' parameter in /eval/admin/manage_task.php.
Skycaiji version 2.5.4 is vulnerable to Cross Site Scripting (XSS). Attackers can achieve backend access by deploying malicious JSON data.
The scquickaccounting module in Store Commander for PrestaShop up to version 3.7.3 allows multiple sensitive SQL calls to be executed with a trivial HTTP request, potentially leading to a blind SQL injection vulnerability.
The scfixmyprestashop module in Store Commander through 2023-05-09 for PrestaShop allows sensitive SQL calls to be executed with a trivial HTTP request, potentially leading to blind SQL injection.
The scexportcustomers module in Store Commander for PrestaShop up to version 3.6.1 allows sensitive SQL calls to be executed with a trivial HTTP request, potentially leading to a blind SQL injection vulnerability.
In WFTPD 3.25, usernames and password hashes are stored in an openly viewable wftpd.ini configuration file within the WFTPD directory. NOTE: this is a product from 2006.
In version 5.0.5 of mipjz, there is a stored XSS vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the 'name' parameter in /app/tag/controller/ApiAdminTagCategory.php.
In version 5.0.5 of mipjz, there is a stored XSS vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description parameter at /index.php?s=/article/ApiAdminArticle/itemAdd.
IceCMS version 1.0.0 is vulnerable to Cross Site Scripting (XSS) attacks, which may allow attackers to inject malicious code into the application.
IceCMS v1.0.0 has insecure permissions, leading to unauthorized access to the API and disclosure of sensitive information.
CVE-2023-2851 describes an improper neutralization of special elements used in SQL commands, allowing command line execution through SQL Injection. This issue affects all versions of AGT Tech Ceppatron software.
Brak sprawdzenia uprawnień dostępu w kliencie M-Files przed wersją 23.5.12598.0 (z wyłączeniem 23.2 SR2 i nowszych) umożliwia podniesienie uprawnień za pomocą aplikacji rozszerzeń interfejsu użytkownika.
CVE-2023-2887 vulnerability affects the CBOT Chatbot, allowing authentication bypass through spoofing. This issue exists in versions Chatbot before Core: v4.0.3.4 and Panel: v4.0.3.7.
A vulnerability in CBOT Chatbot related to improper enforcement of message integrity during transmission in a communication channel allows an adversary to conduct an Adversary in the Middle (AiTM) attack.
The vulnerability in CBOT Chatbot is related to the use of a cryptographically weak pseudo-random number generator, allowing signature spoofing through key recreation.
A vulnerability in CBOT Chatbot allows authorization bypass through a user-controlled key, leading to authentication abuse and bypass.
The vulnerability in CBOT Chatbot related to the generation of incorrect security tokens allows for token impersonation and privilege abuse.
Wtyczka MStore API dla WordPressa jest podatna na obejście uwierzytelniania w wersjach do 3.9.1 włącznie. Problem wynika z niewystarczającej weryfikacji użytkownika podczas synchronizacji koszyka z mobilnego żądania REST API przez wtyczkę.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS