CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
System rezerwacji myjni samochodowych online w wersji 1.0 jest podatny na atak typu SQL Injection poprzez endpoint /ocwbs/admin/?page=bookings/view_details&id=.
Simple Inventory System v1.0 is vulnerable to SQL Injection via /inventory/table_edit_ajax.php. Unsanitized input allows injection of malicious SQL code.
Badminton Center Management System V1.0 is vulnerable to SQL Injection via the 'id' parameter in /bcms/admin/court_rentals/update_status.php. An attacker can exploit this flaw to execute unauthorized database queries.
A directory traversal vulnerability was found in Webbank WeCube version 3.2.2. Attackers can exploit this issue by uploading a crafted ZIP file to access files outside the intended directory.
ACEweb Online Portal 3.5.065 was found to have a SQL injection vulnerability via the 'criteria' parameter in showschedule.awp. An attacker can manipulate database queries, potentially leading to unauthorized data access.
ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp. This allows an attacker to upload arbitrary files to the server.
The TOTOLINK EX1200T device with firmware version V4.1.2cu.5215 is affected by a command injection vulnerability that allows remote arbitrary code execution.
W systemie zamawiania jedzenia online w wersji 1.0 odkryto podatność na wstrzykiwanie SQL poprzez parametr Search w pliku food-search.php.
The D-Link DSL-G2452DG (hardware version T1, firmware ME_2.00) was found to have insecure permission settings. This vulnerability could allow unauthorized users to access sensitive functions or data.
An arbitrary file upload vulnerability in Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file.
SolarView Compact version 6.00 was found to contain a command injection vulnerability via conf_mail.php. An attacker can exploit this to execute arbitrary system commands on the device.
A OS command injection vulnerability exists in the CGI program of Zyxel USG FLEX, ATP, and VPN series firmware. It allows an attacker to modify specific files and execute OS commands on the vulnerable device. Affected versions include USG FLEX 100(W) 5.00-5.21 Patch 1, USG FLEX 200, 500, 700, USG FLEX 50(W), USG20(W)-VPN, ATP, and VPN series.
Wtyczka RSVPMaker dla WordPressa jest podatna na nieautoryzowaną injekcję SQL z powodu braku odpowiedniego zabezpieczenia i parametryzacji danych dostarczanych przez użytkowników w pliku rsvpmaker-api-endpoints.php. Umożliwia to nieautoryzowanym atakującym kradzież wrażliwych informacji z bazy danych w wersjach do 9.2.6 włącznie.
Wtyczka RSVPMaker dla WordPressa jest podatna na nieautoryzowaną injekcję SQL z powodu braku odpowiedniego zabezpieczenia i parametryzacji danych dostarczanych przez użytkowników w zapytaniach SQL w pliku rsvpmaker-util.php. Atakujący mogą uzyskać dostęp do wrażliwych informacji z bazy danych w wersjach do 9.2.5 włącznie.
In F5 BIG-IP versions 16.1.x prior to 16.1.2.2, 15.1.x prior to 15.1.5.1, 14.1.x prior to 14.1.4.6, 13.1.x prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. This allows an attacker to access the management interface without authentication.
In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, there is a SQL injection vulnerability in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping.
An arbitrary file upload vulnerability in Web@rchiv 1.0 allows attackers to execute arbitrary commands via a crafted PHP file.
In Sourcecodester Doctor's Appointment System 1.0, a vulnerability allows remote code execution (RCE) via malicious file upload as an image from the admin panel. An attacker can gain full server control just by knowing the path where images are stored.
A Remote Code Execution (RCE) vulnerability exists in Ruijie RG-EW Series Routers running ReyeeOS up to version 1.55.1915 / EW_3.0(1)B11P55. The flaw is located in the checkNet function within /cgi-bin/luci/api/auth.
A vulnerability in SiteServer CMS version 7.x allows attackers to execute arbitrary code via a crafted plug-in. The flaw stems from insufficient security checks on plug-ins loaded into the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS