CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Paid To Read Script version 2.0.5 has a SQL injection vulnerability via the id parameter in referrals.php.
Paid To Read Script version 2.0.5 has an authentication bypass vulnerability in the admin panel via a direct request, as demonstrated by the fn parameter in admin/viewvisitcamp.php and the uid parameter in admin/userview.php.
An issue was discovered on Ichano AtHome IP Camera devices that allows a remote, unauthenticated user on the LAN to execute arbitrary commands. This is done through the 'noodles' binary running on port 1300, which requires the <system> XML element to specify the command.
Conarc iChannel allows remote attackers to obtain sensitive information, modify the configuration, or cause a denial of service by deleting the configuration via a wc.dll?wwMaint~EditConfig request, which reaches an older version of a West Wind Web Connection HTTP service.
Zivif PR115-204-P-RS web cameras version V2.3.4.2103 contain a hard-coded password 'cat1029' for the root user. The SONIX operating system setup makes this password unchangeable, allowing access to the device via a TELNET session.
CVE-2017-17106 allows unauthenticated remote attackers to obtain credentials for Zivif PR115-204-P-RS V2.3.4.2103 webcams via a standard HTTP request. The vulnerability exists due to a lack of authentication checks in requests to CGI pages.
Zivif PR115-204-P-RS web cameras in versions V2.3.4.2103 and V4.7.4.2121 (and possibly in between versions) are vulnerable to unauthenticated, blind remote command injection via CGI scripts used in the web interface.
The AccessKeys AccessPress Anonymous Post Pro plugin for WordPress versions up to 3.1.9 has an issue with improper input sanitization. This allows an attacker to override settings for allowed file extensions and upload file size, leading to the ability to upload any files to the server.
The CVE-2017-15877 vulnerability in the db.php file in GPWeb 8.4.61 has insecure permissions that allow remote attackers to view the password and user database.
CVE-2017-15875 is a SQL injection vulnerability in the Password Recovery feature in GPWeb 8.4.61. It allows remote attackers to execute arbitrary SQL commands via the 'checkemail' parameter.
The Application Firewall Pack (AFP) component on Kemp Load Balancer devices with software before 7.2.40.1 allows a Security Feature Bypass via an HTTP POST request.
CWEBNET/WOSummary/List in ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows SQL injection via the tradestatus, assetno, assignto, building, domain, jobtype, site, trade, woType, workorderno, or workorderstatus parameter.
Paid To Read Script version 2.0.5 has an SQL Injection vulnerability via the uid parameter in admin/userview.php, the fnum parameter in admin/viewemcamp.php, or the fn parameter in admin/viewvisitcamp.php.
Bus Booking Script version 1.0 has an SQL Injection vulnerability via the txtname parameter in admin/index.php.
FS Lynda Clone version 1.0 has a SQL Injection vulnerability via the keywords parameter in the tutorial/ path.
The BrightSign Digital Signage (4k242) device with firmware version 6.2.63 and below has a directory traversal vulnerability via the rp parameter in /storage.html, allowing an attacker to read or write files.
CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies.
CMS Made Simple (CMSMS) before version 2.2.5 does not properly cache login information in sessions.
Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request.
DedeCMS through 5.7 is vulnerable to SQL Injection via the $_FILES superglobal in plus/recommend.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS