CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities in ActiveBuyAndSell 6.2 allow remote attackers to execute arbitrary SQL commands via the catid parameter to (1) default.asp or (2) buyersend.asp, (3) Administrator ID field in admin.asp, E-mail field in (4) advertiserstart.asp or (5) buyer.asp, or Keyword field in search.asp.
Multiple SQL injection vulnerabilities in Infopop UBB.Threads before 6.5.2 Beta allow remote attackers to execute arbitrary SQL commands via the Number parameter to (1) download.php, (2) modifypost.php, (3) mailthread.php, or (4) notifymod.php, (5) month or (6) year parameter to calendar.php, (7) message parameter to viewmessage.php, (8) main parameter to addfav.php, or (9) posted parameter to grabnext.php.
Unknown vulnerability in Remote Agent for Windows Servers (RAWS) in VERITAS Backup Exec 9.0 through 10.0 for Windows, and 9.0.4019 through 9.1.307 for NetWare, allows remote attackers to gain privileges by copying the handle for the server.
A vulnerability in VERITAS Backup Exec 9.0 through 10.0 for Windows Servers and 9.0.4019 through 9.1.307 for Netware allows a remote attacker to cause a denial of service (Remote Agent crash) by sending a crafted packet to the NDMLSRVR.DLL library or a packet with an invalid (non-zero) 'Error Status' value, leading to a null pointer dereference.
A buffer overflow vulnerability in the VERITAS Backup Exec Web Administration Console (BEWAC) versions 9.0 4367 through 10.0 rev. 5484 allows remote attackers to execute arbitrary code.
Vulnerability in VERITAS Backup Exec Server (beserver.exe) versions 9.0 through 10.0 for Windows allows remote unauthenticated attackers to modify the registry by calling methods to the RPC interface on TCP port 6106.
Multiple SQL injection vulnerabilities in DUware DUamazon Pro 3.0 and 3.1 allow remote attackers to execute arbitrary SQL commands via the iCat, iSub, iPro, and iType parameters in various ASP scripts.
PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e allows remote attackers to execute arbitrary PHP code via the config[include_path] parameter.
Multiple SQL injection vulnerabilities in DUware DUportal PRO 3.4.3 allow remote attackers to execute arbitrary SQL commands via the iChannel, iData, iMem, iCat, offset, and iChannel parameters.
Multiple SQL injection vulnerabilities in DUware DUforum 3.1, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via the iMsg parameter to messages.asp, iFor parameter to post.asp or forums.asp, or id parameter to userEdit.asp. Vectors 1 and 3 were later reported to affect version 3.0.
SQL injection vulnerability in config_settings.php in Cacti before 0.8.6e allows remote attackers to execute arbitrary SQL commands via the id parameter.
Multiple SQL injection vulnerabilities in DUpaypal Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the iCat, iPro, and iSub parameters.
Multiple SQL injection vulnerabilities in DUware DUclassmate 1.2 allow remote attackers to execute arbitrary SQL commands via the iState parameter in default.asp or the iPro parameter in edit.asp.
SQL injection vulnerability in the logon screen of the web front end (NmConsole/Login.asp) for IpSwitch WhatsUp Professional 2005 SP1 allows remote attackers to execute arbitrary SQL commands via the User Name field (sUserName parameter) or Password (sPassword parameter).
SQL injection vulnerability in index.php for MercuryBoard 1.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header.
Multiple SQL injection vulnerabilities in Fortibus CMS 4.0.0 allow remote attackers to execute arbitrary SQL commands via (1) the username or password to logon.asp, (2) WeeklyNotesDisplay.asp, or (3) the Search page.
The XMLRPC server in the Ruby library (libruby) 1.8 sets an invalid default value that prevents security protection using handlers, allowing remote attackers to execute arbitrary commands.
Multiple SQL injection vulnerabilities in login in paFAQ 1.0 Beta 4 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the username or id parameters.
Multiple SQL injection vulnerabilities in Ublog Reload 1.0.5 allow remote attackers to execute arbitrary SQL commands via the ci, d, or m parameter to index.asp, or the bi parameter to blog_comment.asp.
Stack-based buffer overflow in VERITAS Backup Exec Remote Agent for Windows and Netware. An attacker can remotely execute arbitrary code by sending a specially crafted CONNECT_CLIENT_AUTH request with a long password.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS