CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities in Omnistar KBase 4.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter in users/comments.php, (2) category_id and (3) id parameters in users/kb.php.
In edmoBBS 0.9 and earlier, multiple SQL injection vulnerabilities exist in edmobbs9r.php. Remote attackers can execute arbitrary SQL commands via the 'table' and 'messageID' parameters.
Enterprise Connector 1.0.2 and earlier contain multiple SQL injection vulnerabilities. A remote attacker can execute arbitrary SQL commands via the messageid parameter in send.php or a delete action in messages.php.
A PHP remote file inclusion vulnerability in athena.php of Oliver May Athena PHP Website Administration 0.1a allows remote attackers to execute arbitrary PHP code via a URL in the athena_dir parameter.
SQL injection vulnerability in index.php in AllWeb search 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the search parameter.
Buffer overflow vulnerability in unalz before version 0.53 allows remote attackers to execute arbitrary code via long file names in ALZ archives.
In Zainu 2.0 and earlier, multiple SQL injection vulnerabilities exist in the search action. A remote attacker can execute arbitrary SQL commands via the 'term' and 'start' parameters in index.php.
SQL injection vulnerability in search.php in AtlantisFAQ Knowledge Base Software 2.03 and earlier allows remote attackers to execute arbitrary SQL commands via the searchStr parameter.
Multiple SQL injection vulnerabilities in Softbiz Resource Repository Script 1.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sbres_id parameter in details_res.php, refer_friend.php, and report_link.php, and the sbcat_id parameter in showcats.php.
Multiple SQL injection vulnerabilities in Simple Document Management System (SDMS) 2.0-CVS and earlier allow remote attackers to execute arbitrary SQL commands via the folder_id parameter in list.php and the mid parameter in a view action to messages.php.
SQL injection vulnerability in netzbr.php in Netzbrett 1.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the p_entry parameter in an entry command to index.php.
SQL injection vulnerability in topic.php in ShockBoard 3.0 and 4.0 allows remote attackers to execute arbitrary SQL commands via the offset parameter.
Multiple SQL injection vulnerabilities in Joels Bulletin board (JBB) 0.9.9rc3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) nr parameter in topiczeigen.php, (2) forum and (3) zeigeseite parameters in showforum.php, (4) forum parameter in newtopic.php, and (5) tidnr parameter in neuerbeitrag.php.
Multiple SQL injection vulnerabilities in K-Search 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the term, id, stat, and source parameters to index.php, and through the image parameters with an add request.
Stack-based buffer overflow in ktools library 0.3 and earlier, used in products such as centericq, orpheus, motor, and groan, allows local or remote attackers to execute arbitrary code via a long parameter to the VGETSTRING macro.
PHP remote file inclusion vulnerability in content.php in phpGreetz 0.99 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the content parameter.
PHP remote file inclusion vulnerability in q-news.php in Q-News 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the id parameter.
A memory leak in the ip6_input_finish function in ip6_input.c in Linux kernel 2.6.12 and earlier might allow attackers to cause a denial of service via malformed IPv6 packets with unspecified parameter problems, which prevents the SKB from being freed.
SQL injection vulnerability in snews.php in sNews 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id and category parameters to index.php.
SQL injection vulnerability in process.php of 1-2-3 music store allows remote attackers to execute arbitrary SQL commands via the AlbumID parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS