CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in index.php of ContentServ 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the StoryID parameter.
SQL injection vulnerability in default.asp in Media2 CMS Shop 18.x allows remote attackers to execute arbitrary SQL commands via the item parameter. The provenance of this issue is unknown; the details were obtained solely from third party sources.
SQL injection vulnerability in index.php in Marwel 2.7 and earlier allows remote attackers to execute arbitrary SQL commands via the show parameter.
Miraserver 1.0 RC4 and earlier versions contain multiple SQL injection vulnerabilities in the page, id, and cat parameters, allowing remote attackers to execute arbitrary SQL commands.
SQL injection vulnerability in printer_friendly.cfm in e-publish CMS 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Multiple SQL injection vulnerabilities exist in CategoryResults.cfm in Honeycomb Archive and Honeycomb Archive Enterprise 3.0. Remote attackers can execute arbitrary SQL commands via the series, cat_parent, cat, and div parameters.
A buffer overflow in Mercury Mail Transport System 4.01b allows remote attackers to execute arbitrary code via a long request to TCP port 105.
An unspecified vulnerability in Kerio WinRoute Firewall before version 6.1.3 allows remote attackers to cause a denial of service (crash) via certain RTSP streams.
Dev-Editor 3.0 allows remote attackers to access any directory outside the web root whose name is a substring of the web root directory name.
Unspecified vulnerability in Teamwork 3 before alpha 1.7, related to a menu security bug. Impact and attack vectors are unknown.
SQL injection vulnerability in CitySoft Community Enterprise 4.x allows remote attackers to execute arbitrary SQL commands via the nodeID, pageID, ID, and parentid parameters in index.cfm, and the documentFormatId parameter in document/docWindow.cfm.
SQL injection vulnerability in main_content.asp in Acidcat 2.1.13 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter to default.asp.
SQL injection vulnerability in Page.asp of Baseline CMS version 1.95 and earlier allows remote attackers to execute arbitrary SQL commands via the SiteNodeID parameter.
Multiple SQL injection vulnerabilities in Bitweaver 1.1 and 1.1.1 beta allow remote attackers to execute arbitrary SQL commands via the sort_mode, post_id, and blog_id parameters, which are not properly sanitized by the convert_sortmode function in kernel/BitDb.php.
The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to '.dll' followed by arguments such as '~0' through '~9', which causes ntdll.dll to produce a return value that is not correctly handled by IIS, potentially leading to code execution rather than just a denial of service as originally believed.
SQL injection vulnerability in UStore allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields. The provenance of this information is unknown; the details are obtained solely from third party information.
An unspecified vulnerability in WBEM Services A.01.x before A.01.05.12 and A.02.x before A.02.00.08 on HP-UX B.11.00 through B.11.23 allows remote attackers to cause an unspecified denial of service via unknown attack vectors.
In toendaCMS 0.6.2.1, configured to use a SQL database, a SQL injection vulnerability exists in index.php. Remote attackers can execute arbitrary SQL commands via the id parameter.
The login page in Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to bypass authentication and gain privileges as other users via a modified user_id parameter and a '/' in the encoded_pw parameter.
The vulnerability in Adobe ColdFusion MX 7.0 exposes the password hash of the Administrator in an API call, allowing local developers to obtain the hash and gain privileges.