CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability allows remote code execution via PHP file inclusion by manipulating the 'view' parameter in index.php of AlstraSoft EPay Pro 2.0. An attacker can modify this parameter to point to a URL containing malicious code, which will be executed on the server.
Buffer overflow in the getConfig function in Aeon 0.2a and earlier allows local users to gain privileges via a long HOME environment variable.
PHP remote file inclusion vulnerability in index_header.php of EncapsBB 0.3.2_fixed (and possibly other versions) via the root parameter allows remote attackers to execute arbitrary PHP code.
In PHP before version 4.3.11, an integer overflow in the exif_process_IFD_TAG function in exif.c may allow remote attackers to execute arbitrary code via an IFD tag that leads to a negative byte count.
SQL injection vulnerability in PhotoPost PHP Pro 5.x allows remote attackers to execute arbitrary SQL commands via the 'sl' parameter in showmembers.php or the 'photo' parameter in showphoto.php.
Mafia Blog .4 BETA does not properly protect the admin directory, which allows remote attackers to execute arbitrary PHP code by using writeinfo.php to inject the code into info.php.
Buffer overflow in the PopUp Plus 2.0.3.8 plugin for Miranda IM, with 'Use SmileyAdd Setting' enabled, allows remote attackers to execute arbitrary code.
By design, the built-in FTP server for iSeries AS/400 systems does not support a restricted document root, which allows attackers to read or write arbitrary files, including sensitive QSYS databases, via a full pathname in a GET or PUT request.
Vulnerability in Cisco IOS 12.2T, 12.3, and 12.3T involves improper processing of ISAKMP profile with XAUTH authentication after Phase 1 negotiation. A remote attacker can bypass XAUTH and proceed to Phase 2 negotiations.
A vulnerability in Firefox before version 1.0.3 and Mozilla Suite before version 1.7.7 allows a remote attacker to execute arbitrary code via a javascript: URL that is executed when the user selects the 'Show javascript' option after a popup is blocked.
The administration protocol in Kerio WinRoute Firewall 6.x up to 6.0.10, Personal Firewall 4.x up to 4.1.2, and MailServer up to 6.0.8 allows remote attackers to quickly obtain passwords that are 5 characters or less via brute force methods.
PHP remote file inclusion vulnerability in index.php of All4WWW-Homepagecreator 1.0a allows remote attackers to execute arbitrary PHP code by modifying the 'site' parameter to reference a URL on a remote server containing malicious code.
Multiple SQL injection vulnerabilities in index.php in eGroupware before version 1.0.0.007 allow remote attackers to execute arbitrary SQL commands via the 'filter' or 'cats_app' parameters.
SQL injection vulnerability in the Update_Events function in events_functions.asp in MaxWebPortal 1.33 and earlier allows remote attackers to execute arbitrary SQL commands via the EVENT_ID parameter, as demonstrated using events.asp.
Vulnerability in Shoutbox SCRIPT 3.0.2 and earlier allows remote attackers to obtain sensitive information via a direct request to db/settings.dat, which displays usernames and password hashes.
A vulnerability in loader.php of Ariadne CMS 2.4 that allegedly allows remote PHP code injection by modifying the ariadne parameter to point to a URL containing malicious code. The vendor disputes this, stating that loader.php first requires the ariadne.inc file which defines the $ariadne variable, preventing modification by an attacker. CVE personnel partially verified the dispute via source code inspection of Ariadne 2.4 as of July 5, 2005.
SQL injection vulnerability in news.php in FlexPHPNews 0.0.3 allows remote attackers to execute arbitrary SQL commands via the newsid parameter.
PHPOpenChat 3.0.1 and earlier contain multiple PHP remote file inclusion vulnerabilities, allowing an attacker to execute arbitrary PHP code via the phpbb_root_path, poc_root_path, and sourcedir parameters.
PHP remote file inclusion vulnerability in main_index.php in AZ Bulletin Board (AZbb) 1.0.07a through 1.0.07c allows remote attackers to execute arbitrary PHP code by modifying the (1) dir_src or (2) abs_layer parameter to reference a URL on a remote web server that contains the code.
An unknown vulnerability in AIX 5.3.0 configured as an NIS client allows remote attackers to gain root privileges.