CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in pmlite.php in RunCMS versions 1.2 and 1.3a. Remote attackers can execute arbitrary SQL commands via the to_userid parameter.
SQL injection vulnerability in search.php of webSPELL 4.01.00 and earlier allows remote attackers to inject arbitrary SQL commands via the title_op parameter.
SQL injection vulnerability in member_login.php in PHP Classifieds 6.18–6.20. Remote attackers can execute arbitrary SQL commands via the username (email field) and password parameters.
In CALimba 0.99.2 beta and earlier, multiple SQL injection vulnerabilities exist in rb_auth.php via the login and password parameters. Remote attackers can execute arbitrary SQL commands and bypass login authentication.
A PHP remote file inclusion vulnerability in application.php in nicecoder.com indexu 5.0.0 and 5.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the base_path parameter.
Multiple SQL injection vulnerabilities in Carey Briggs PHP/MYSQL Timesheet 1 and 2 allow remote attackers to execute arbitrary SQL commands via the yr, month, day, and job parameters in index.php and changehrs.php.
Ansilove before version 1.03 does not filter uploaded file extensions, allowing remote attackers to execute arbitrary code by uploading files with dangerous extensions and then accessing them directly in the upload directory.
Unspecified vulnerabilities in Zen Cart before version 1.2.7 allow remote attackers to cause unknown impact via unspecified vectors related to other attempted exploits than SQL injection.
Multiple buffer overflows in NullSoft Winamp 5.13 and earlier allow remote attackers to execute arbitrary code via specially crafted m3u or pls files with long URLs ending in .wma or long filenames.
A double free vulnerability in isode.eddy in Isode M-Vault Server 11.3 allows remote attackers to execute arbitrary code via a crafted LDAP request, as demonstrated by ProtoVer Sample LDAP.
Zen Cart before version 1.2.7 does not protect the admin/includes directory, allowing remote attackers to cause unknown impact via unspecified vectors, likely direct requests.
A buffer overflow vulnerability in Metamail 2.7-50 occurs when processing a long 'boundary' attribute in email messages. An attacker can send a crafted email causing a denial of service or potentially arbitrary code execution.
TTS Time Tracking Software 3.0 contains multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
SQL injection vulnerability in Zen Cart before version 1.2.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
In sNews 1.3, the index.php file is vulnerable to SQL injection via the category and id parameters. This allows a remote attacker to execute arbitrary SQL commands on the database.
A format string vulnerability in powerd.c of Power Daemon (powerd) version 2.0.2 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the WHATIDO variable.
In Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier, the change_password.php script does not verify the old password when a user changes the password. This allows a remote attacker to change the password without knowing the old one, potentially leading to unauthorized access.
In Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier, the add_user.php script does not check user privileges when adding a new administrative user. This allows a remote attacker to create an admin account without authorization.
In Virtual Hosting Control System (VHCS) version 2.4.7.1 and earlier, the check_login function in login.php does not exit after authentication failure. This allows a remote attacker to gain unauthorized access to the system.
Heap-based buffer overflow in the bitmap processing routine of Microsoft Windows Media Player. A crafted BMP file with size 0 but containing extra data allows remote attackers to execute arbitrary code.