CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in create.php of Widget Imprint 1.0.26 and earlier allows remote attackers to execute arbitrary SQL commands via the product_id parameter.
SQL injection vulnerability in calendar.php in Codewalkers ltwCalendar (aka PHP Event Calendar) 4.2, 4.1.3, and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
SQL injection vulnerability in SimpleBBS 1.1 allows remote attackers to execute arbitrary SQL commands via unspecified search module parameters.
The vulnerability in Help Desk Reloaded Free Help Desk is that the install.php file is not removed or protected after installation is complete. A remote attacker can send a direct request to install.php, then navigate to accountsetup.php and create a new user account, leading to unauthorized privilege escalation.
SQL injection vulnerability in index.php in Relative Real Estate Systems 1.02 and earlier allows remote attackers to execute arbitrary SQL commands via the mls parameter.
SQL injection vulnerability in Widget Property 1.1.19 allows remote attackers to execute arbitrary SQL commands via the property_id, zip_code, property_type_id, price, and city_id parameters to property.php.
SQL injection vulnerability in KBase Express 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter in category.php and search parameters in search.php.
Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the cid and catid parameters in day.php, week.php, month.php, and year.php.
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to inject SQL queries via the srch_text parameter in the Search and Sort option. This can lead to disclosure of system paths and potential arbitrary SQL command execution.
SAPID CMS before version 1.2.3.03 allows remote attackers to bypass authentication via direct requests to the usr/system files: insert_file.php, insert_image.php, insert_link.php, insert_qcfile.php, and edit.php.
Multiple unspecified vulnerabilities in SAPID CMS before version 1.2.3.03, related to newly registered users and possibly authorization checks, have unknown impact and attack vectors involving files mvc/controller/user_request_analysis.inc.php and usr/xml/ddc/authorization.xml.
Multiple SQL injection vulnerabilities in phpYellowTM Pro Edition and Lite Edition 5.33 allow remote attackers to execute arbitrary SQL commands via the haystack parameter in search_result.php or the ckey parameter in print_me.php.
Multiple SQL injection vulnerabilities in Absolute Shopping Package Solutions (ASPS) Shopping Cart Professional 2.9d and earlier, and Lite 2.1 and earlier, allow remote attackers to execute arbitrary SQL commands via the srch_product_name parameter in adv_search.asp and the b_search parameter in bsearch.asp.
MailEnable Professional 1.6 and earlier and Enterprise 1.1 and earlier contain multiple unspecified vulnerabilities that allow attackers to cause a denial of service (crash) via invalid IMAP commands.
Multiple buffer overflows in WinEggDropShell remote access trojan (RAT) 1.7 allow remote attackers to execute arbitrary code via a long GET request to the HTTP server, or long USER or PASS commands to the FTP server.
Multiple SQL injection vulnerabilities in Tradesoft CMS allow remote attackers to execute arbitrary SQL commands via unspecified attack vectors.
Multiple SQL injection vulnerabilities in Instant Photo Gallery 1 and earlier allow remote attackers to execute arbitrary SQL commands via the cat_id parameter in portfolio.php and the cid parameter in content.php.
SQL injection vulnerability in article.php in Pineapple Technologies Lore 1.5.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
The IKEv1 implementation in Astaro Security Linux before version 6.102 contains a vulnerability that allows a remote attacker to cause a denial of service and potentially execute arbitrary code via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. Due to lack of details in the advisory, it is unclear which of CVE-2005-3666, CVE-2005-3667, or CVE-2005-3668 apply to this issue.
A memory leak vulnerability in the Avaya TN2602AP IP Media Resource 320 circuit pack before vintage 9 firmware allows remote attackers to cause a denial of service (memory consumption) via crafted VoIP packets.