CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Wielokrotne podatności na wstrzykiwanie SQL w Dominios Europa PICRATE (znanym również jako TAL RateMyPic) w wersji 1.0 pozwalają zdalnym atakującym na wykonywanie dowolnych poleceń SQL poprzez parametry (1) id, (2) voteid i (3) vfiel w pliku index.php oraz poprzez parametry (4) nick, (5) email, (6) city, (7) messen i (8) message w formularzu w pliku add.php.
PHP remote file inclusion vulnerability in Enterprise Timesheet and Payroll Systems (EPS) 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the absolutepath parameter in cal.php. The details are obtained solely from third party information.
Wielokrotne podatności na wstrzykiwanie SQL w My Photo Scrapbook 1.0 i wcześniejszych wersjach umożliwiają zdalnym atakującym wykonywanie dowolnych poleceń SQL za pomocą parametru key w plikach Displayview.asp oraz Details_Photo_bv.asp.
In MyBulletinBoard (MyBB) 1.1.2, the domecode function in inc/functions_post.php allows remote attackers to execute arbitrary PHP code via the username field, which is used in a preg_replace call with the /e (executable) modifier.
SQL injection vulnerability in vs_search.php of Arantius Vice Stats before version 1.0.1 allows remote attackers to execute arbitrary SQL commands via unknown vectors. This issue is distinct from CVE-2006-2972.
SQL injection vulnerability in block_forum_topic_new.php of ViArt Shop Free 2.5.5 and other distributions (Light, Standard, Enterprise) allows remote attackers to execute arbitrary SQL commands via unknown vectors, likely involving the forum_id parameter.
SQL injection vulnerability in big.php of Mafia Moblog 0.6M1 and earlier. Remote attackers can execute arbitrary SQL commands via the img parameter.
Multiple SQL injection vulnerabilities in month.php of PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the catid and cid parameters.
Unspecified vulnerability in usermgr.php in Coppermine Photo Gallery before version 1.4.7. It may allow remote attacks with unknown impact, possibly related to authorization or authentication errors.
SQL injection vulnerability in vs_resource.php of Arantius Vice Stats versions 0.5b and 1.0. Remote attackers can execute arbitrary SQL commands via the ID parameter.
SQL injection vulnerability in inc_header.asp in Snitz Forum 3.4.05 and earlier allows remote attackers to execute arbitrary SQL commands via the %strCookieURL%.GROUP parameter in a cookie.
A stack-based buffer overflow in CesarFTP 0.99g and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long MKD command.
A PHP remote file inclusion vulnerability in sql_fcnsOLD.php of Emergenices Personnel Information System (Empris) 20020923 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phormationdir parameter.
SQL injection vulnerability in files.asp in OfficeFlow 2.6 and earlier allows remote attackers to execute arbitrary SQL commands via the Project parameter.
An unspecified vulnerability in CGI-RESCUE WebFORM 4.1 and earlier allows remote attackers to inject email headers, facilitating spam sending. Details are obtained from third-party information.
Xtreme Scripts Download Manager 1.0 contains multiple PHP remote file inclusion vulnerabilities. An attacker can execute arbitrary PHP code remotely by supplying a malicious URL in the 'root' parameter in several scripts, including download.php and manager.php.
A remote file inclusion vulnerability in Joomla! 1.0 allows attackers to execute arbitrary PHP code by supplying a URL in the 'includepath' parameter in includes/joomla.php.
Multiple SQL injection vulnerabilities were found in SelectaPix 1.31. An attacker can remotely execute arbitrary SQL commands via the albumID, imageID, username, and password parameters.
A stack-based buffer overflow in the WWW Proxy Server of Qbik WinGate 6.1.1.1077 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long URL HTTP request.
An unspecified vulnerability in Microsoft NetMeeting 3.01 allows remote attackers to cause a denial of service (crash or CPU consumption) and possibly execute arbitrary code via crafted inputs that trigger memory corruption.