CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The NETGEAR WGT624 wireless DSL router has a default account with username "Gearguy" and password "Geardog", allowing remote attackers to modify the device configuration. Note that not all WGT624 routers may be affected.
Multiple SQL injection vulnerabilities in N8cms versions 1.1 and 1.2 allow remote attackers to execute arbitrary SQL commands via the dir and page_id parameters to index.php.
Multiple SQL injection vulnerabilities exist in sendcard.php in sendcard before version 3.3.0. Remote attackers can execute arbitrary SQL commands via unspecified parameters.
Unspecified vulnerability in the local weblog publisher in Nidelven IT Issue Dealer before version 0.9.96. Impact and attack vectors are unknown.
PHP remote file inclusion vulnerability in index.php of Top sites de PixelArtKingdom allows attackers to include and execute arbitrary files via the 'page' parameter.
A PHP remote file inclusion vulnerability in index.php of one or more ActiveCampaign products, likely SupportTrio, allows remote attackers to include and execute arbitrary files via the page parameter.
The default configuration of the DNS Server service on Windows Server 2003, Windows 2000, and Microsoft DNS Server on Windows NT 4.0 allows recursive queries and provides additional delegation information to arbitrary IP addresses. This enables remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses.
SQL injection vulnerability in topics.php of phpWebSite 0.10.2 and earlier allows remote attackers to execute arbitrary SQL commands via the topic parameter.
A direct static code injection vulnerability in func.inc.php in freeForum before 1.2.1 allows remote attackers to execute arbitrary PHP code via the X-Forwarded-For and Client-Ip HTTP headers, which are stored in Data/flood.db.php.
SQL injection vulnerability in misc.php in MyBulletinBoard (MyBB) 1.03 (and 1.04) allows remote attackers to execute arbitrary SQL commands by setting the comma variable via the comma parameter in a cookie when register_globals is enabled.
The ncprwsnt service in NCP Network Communication Secure Client 8.11 Build 146 (and possibly other versions) allows local users to execute arbitrary code by modifying the connect.bat script, which is automatically executed by the service after a connection is established.
SQL injection vulnerability in yazdir.asp in Cilem Hiber 1.1 allows remote attackers to execute arbitrary SQL commands via the haber_id parameter. This product is also referred to as Cilem News.
SQL injection vulnerability in vuBB 0.2 allows remote attackers to execute arbitrary SQL commands via the 'pass' parameter in a cookie.
A vulnerability in the automount service in Mac OS X 10.4.5 and earlier allows remote file servers to cause a denial of service (unresponsiveness) or execute arbitrary code via unspecified vectors that cause automount to mount file systems with reserved names.
A vulnerability in Thomson SpeedTouch modem running firmware 5.3.2.6.0 allows remote attackers to create user accounts that cannot be deleted by the administrator. This is achieved by injecting script code into the '31' parameter of the NewUser function, which is not filtered during account creation but is sanitized in the admin interface, preventing deletion.
ShoutLIVE 1.1.0 contains multiple direct static code injection vulnerabilities in savesettings.php. Remote attackers can write arbitrary PHP code to settings.php via request variables.
SQL injection vulnerability in DCI-Taskeen 1.03 allows remote attackers to execute arbitrary SQL commands via the id or action parameter in basket.php, or id or page parameter in cat.php.
SQL injection vulnerability in profil.php in PwsPHP 1.2.3 (and earlier versions) allows remote attackers to execute arbitrary SQL commands via the aff_news_form parameter. This is a different vulnerability than CVE-2005-1509.
The sondages module in PwsPHP 1.2.3 contains an SQL injection vulnerability. Remote attackers can execute arbitrary SQL commands via the id parameter in requests to index.php.
Archangel Weblog 0.90.02 allows remote attackers to bypass authentication by setting the ba_admin cookie to 1.