CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A SQL injection vulnerability has been found in Hotel and Tourism Reservation 1.0 in the file /admin/add_room.php. An attacker can remotely manipulate arguments delete_image, edit, description, number, price, rooms, or type, leading to unauthorized database access. The exploit has been published and may be used.
A vulnerability was found in mjperpinosa stumasy up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be. An unknown function in /PHP/objects/notes within the Note Handler/Assignment Handler component allows authorization bypass via manipulation of the assignment_item_id argument. The attack is remotely exploitable and the exploit is public.
A SQL injection vulnerability was discovered in mjperpinosa stumasy up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be in the Notes_controller::accessing_dictionary_authorization function. Remote attacks are possible by manipulating the Password argument. The exploit has been publicly released, increasing the risk of exploitation.
A vulnerability was found in mjperpinosa stumasy up to version 327d1b0f2915ba79d7ef8ebb74553e987609d9be in the eval function of calculate.php. Manipulating the mathematical_sentence argument allows remote code injection. The exploit is publicly available and may be used.
A SQL Injection vulnerability was found in Real State Services 1.0 in the /addprojectsale.php file. An attacker can remotely manipulate the amen argument, leading to SQL injection.
A SQL Injection vulnerability has been detected in code-projects Real State Services 1.0. The flaw exists in the /addprojectrent.php file, where the amen argument is susceptible to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.
A SQL injection vulnerability has been found in Real State Services 1.0 in the /single-list_rent.php file. Manipulating the ID argument allows remote exploitation. A public exploit increases the risk of attacks.
A SQL injection vulnerability has been discovered in code-projects Real State Services 1.0 in the file /normalHomeRent.php. An attacker can remotely manipulate the loc argument, leading to unauthorized database access. The exploit has been publicly released, increasing the risk of attacks.
A SQL injection vulnerability was found in Real State Services 1.0 in the file /normalHomeSale.php. An attacker can remotely manipulate the 'loc' argument, leading to SQL injection. The exploit is publicly available.
A SQL injection vulnerability was found in Hanwang e-Face General Management Platform 6.3.5.4 in the file /sysAuthStr/querySysAuthStr.do. An attacker can remotely manipulate the order argument, leading to SQL injection. The exploit is publicly available.
A vulnerability was found in Ruijie RG-UAC up to version 1.0-R1.8.2.p5 in the file user_auth_commit.php. An unknown function allows unrestricted file upload via manipulation of the upload_image argument. The attack can be performed remotely and the exploit has been made public.
A SQL injection vulnerability has been found in Smart Parking System 1.0 in the file /parkings/parkings.php. An unknown function allows manipulation of the street/city/status arguments, enabling remote SQL injection. The exploit has been publicly disclosed.
A SQL injection vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0 in the /edit_product.php file via the ID argument. The attack can be performed remotely and the exploit has been published.
A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /edit_coursea.php. An attacker can remotely manipulate the ID argument, leading to SQL injection. The exploit is publicly available.
A SQL injection vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. The issue is in the /edit_exam.php file, where the ID argument is vulnerable to manipulation. The attack can be performed remotely, and the exploit has been publicly disclosed.
A vulnerability in TidGi-Desktop up to version 0.13.0 was found in the Git Repository Import component. An unknown function in loadWikiTiddlersWithSubWikis.ts allows remote code injection. The exploit is public and could be used.
A vulnerability was found in UTT HiPER 1250GW up to version 3.2.7-210907-180535 in the file /goform/ConfigWirelessBase_5g. Manipulation of the ssid argument leads to a stack-based buffer overflow, potentially allowing remote code execution. The exploit has been publicly disclosed.
A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0 in the register.php file. Manipulation of the role argument during registration can lead to improper privilege management. The attack can be performed remotely and the exploit has been published.
A security vulnerability has been discovered in SourceCodester Pizzafy E-Commerce System 1.0, specifically in the file /admin/ajax.php?action=confirm_order. The ID argument is susceptible to SQL injection, allowing remote attacks. The exploit has been publicly released.
A SQL injection vulnerability was found in code-projects Online Examination 1.0 in the head.php file. Manipulating the uname or password arguments allows remote exploitation. The exploit has been publicly disclosed and may be used.