CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in news.php in NMDeluxe before version 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
The vulnerability in register.php in PunBB 1.2.10 allows an attacker to cause a Denial of Service (DoS) by flooding the system with new user registrations. This can overwhelm the server and make the forum unavailable.
Aztek Forum 4.0 contains a vulnerability that allows a remote attacker to obtain sensitive information, such as usernames and passwords, by sending a "*/*" string in the msg parameter to index.php. This flaw exposes the data in a MySQL error message, possibly due to a forced SQL error or SQL injection.
A directory traversal vulnerability in the FileSession object of Mod_python module 3.2.7 for Apache allows local users to execute arbitrary code via a crafted session cookie.
Multiple SQL injection vulnerabilities in NZ Ecommerce allow remote attackers to execute arbitrary SQL commands via the informationID or ParentCategory parameter to index.php. This could lead to unauthorized database access.
A PHP remote file inclusion vulnerability in logIT 1.3 and 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the 'pg' parameter.
Kaspersky Antivirus 5.0.5 and 5.5.3 contain a vulnerability that allows a remote attacker to cause a denial of service via excessive CPU and memory consumption. The attack vector is unknown.
SQL injection vulnerability in index.asp in Total Ecommerce 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. It is unclear whether this report is associated with a specific product.
A buffer overflow vulnerability in the sgetstr function in shared/cube.h in Sauerbraten 2006_02_28 and earlier, derived from the Cube engine, allows remote attackers to execute arbitrary code via long input data streams.
Pixelpost 1.5 beta 1 and earlier contain multiple SQL injection vulnerabilities. An attacker can remotely execute arbitrary SQL commands via the showimage parameter in index.php and the USER_AGENT, HTTP_REFERER, and HTTP_HOST HTTP headers in the book_vistor function in includes/functions.php.
A vulnerability in htpasswd used in Acme thttpd 2.25b and possibly other products like Apache allows local users to gain privileges via shell metacharacters in command line arguments passed to the system function.
PHP-Stats 0.1.9.1 and earlier contain a vulnerability in admin.php that allows remote attackers to bypass authentication, gain administrator privileges, and execute arbitrary PHP code by modifying the option[admin_pass] parameter and setting the pass_cookie to the MD5 hash of the specified password.
SQL injection vulnerability in forgotten_password.php in PluggedOut Nexus 0.1 allows remote attackers to execute arbitrary SQL commands via the email parameter.
Multiple buffer overflows in htpasswd, used in Acme thttpd 2.25b and possibly other products like Apache, may allow local users to gain privileges via a long command line argument or a long line in a file.
PHP-Stats 0.1.9.1 and earlier contains multiple SQL injection vulnerabilities. Remote attackers can execute arbitrary SQL commands via the option[prefix] parameter in admin.php and the PC_REMOTE_ADDR HTTP header in click.php.
The vulnerability in kpdf results from incomplete application of patches from xpdf related to CVE-2005-3627. This allows attackers to exploit flaws that were not fully fixed.
PHP-Stats 0.1.9.1 and earlier contains a directory traversal vulnerability via the option[language] and option[template] parameters in admin.php and other scripts. A remote unauthenticated attacker can read and potentially execute arbitrary files on the server.
A format string vulnerability in the visualization function in Liero Xtreme 0.62b and earlier allows remote attackers to execute arbitrary code via format string specifiers in a nickname, dedicated server name, or map name in a level (.lxl) file.
SQL injection vulnerability in Invision Power Board (IPB) 2.1.5 in index.php during a showtopic operation. Remote attackers can execute arbitrary SQL commands via the st parameter.
An unspecified vulnerability in the session handling of Geeklog versions 1.4.x before 1.4.0sr2, 1.3.11 before 1.3.11sr5, 1.3.9 before 1.3.9sr5, and possibly earlier versions allows attackers to gain privileges as arbitrary users via unknown vectors.