CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.05)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A critical vulnerability was found in Hospital Management System version 1.0, affecting unknown code in the file patientappointment.php. Manipulation of the arguments loginid, password, mobileno, appointmentdate, appointmenttime, patiente, dob, doct, and city leads to SQL injection.
A critical vulnerability was found in Hospital Management System version 1.0. Manipulation of the 'address' argument in the patient.php file leads to SQL injection, which can be executed remotely.
A critical vulnerability was found in Hospital Management System version 1.0, affecting some unknown functionality of the file patientforgotpassword.php. Manipulation of this file leads to SQL injection.
A critical vulnerability has been found in Campcodes Beauty Salon Management System version 1.0. Manipulation of the id argument in the edit_product.php file leads to SQL injection, allowing for remote attacks.
A critical vulnerability was found in SourceCodester House Rental and Property Listing System version 1.0. The issue affects an unknown function in the btn_functions.php file, leading to unrestricted file uploads.
A vulnerability was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0 that allows unrestricted file uploads by manipulating the userFile argument in the /Service/FileHandler.ashx file.
A vulnerability was found in the Chengdu Flash Flood Disaster Monitoring and Warning System that allows unrestricted file uploads by manipulating the 'file' argument in the /Controller/Ajaxfileupload.ashx file.
A critical vulnerability was found in IBOS OA 4.5.5, affecting the actionEdit function of the file ?r=officialdoc/officialdoc/edit of the Mobile Notification Handler component. Manipulation of this function leads to SQL injection.
A critical vulnerability was found in IBOS OA version 4.5.5, affecting unknown processing of the file ?r=article/category/del in the Delete Category Handler component. Manipulation of this file leads to SQL injection.
A critical vulnerability has been found in the Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. It affects unknown code in the file /App_Resource/UEditor/server/upload.aspx, leading to unrestricted file uploads.
A critical vulnerability was found in the Gen Technology Four Mountain Torrent Disaster Prevention and Control of Monitoring and Early Warning System affecting an unknown part of the file /Duty/AjaxHandle/UploadFloodPlanFileUpdate.ashx. Manipulation of the argument Filedata leads to unrestricted file uploads.
Version 1.6.3 of eyoucms was found to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt.
A vulnerability has been found in Bug Finder Foody Friend 1.0 that allows unrestricted file uploads by manipulating the profile_picture argument in the /user/profile file of the Profile Picture Handler component.
A critical vulnerability was found in Bug Finder ChainCity Real Estate Investment Platform 1.0, affecting an unknown functionality of the file /property in the GET Parameter Handler component. Manipulation of the argument name leads to SQL injection.
A critical vulnerability was found in Weaver e-cology, affecting unknown processing of the file filelFileDownloadForOutDoc.class in the HTTP POST Request Handler component. Manipulating the argument fileid with the input 1+WAITFOR+DELAY leads to SQL injection.
A vulnerability was found in Beijing Netcon NS-ASG 6.3, affecting an unknown part of the file /admin/test_status.php. The manipulation leads to direct request, which may be exploited by attackers.
Version 10.9.1.42602 of Office Suite Premium was found to contain a reflected XSS vulnerability via the filter parameter at /api?path=files.
The web interface on multiple Samsung Harman AMX N-Series devices allows directory listing for the /tmp/ directory without authentication, exposing sensitive information such as command history and screenshots of the file being processed.
Alkacon OpenCMS version 15.0 has an arbitrary file upload vulnerability in the /workplace#!explorer component that allows attackers to execute arbitrary code by uploading a crafted PNG file.
Version 10.9.1.42602 of Office Suite Premium was found to contain a reflected XSS vulnerability via the id parameter at /api?path=profile.