107 matches found
CVE-2025-64176
ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish to the /data directory of the web application via the backup import feature. When importing a backup, an attacker can first choose a .zip...
CVE-2025-64176
ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish to the /data directory of the web application via the backup import feature. When importing a backup, an attacker can first choose a .zip...
CVE-2025-64176 ThinkDashboard: Arbitrary File Upload vulnerability in the Backup Import Feature
ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish to the /data directory of the web application via the backup import feature. When importing a backup, an attacker can first choose a .zip...
EUVD-2025-38185
ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish to the /data directory of the web application via the backup import feature. When importing a backup, an attacker can first choose a .zip...
CVE-2025-64176 ThinkDashboard: Arbitrary File Upload vulnerability in the Backup Import Feature
ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish to the /data directory of the web application via the backup import feature. When importing a backup, an attacker can first choose a .zip...
CVE-2025-64176 ThinkDashboard: Arbitrary File Upload vulnerability in the Backup Import Feature
ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish to the /data directory of the web application via the backup import feature. When importing a backup, an attacker can first choose a .zip...
CVE-2025-64176
ThinkDashboard versions ≤ 0.6.7 are affected by an Arbitrary File Upload vulnerability in the Backup Import feature. An attacker can upload any file to the /data directory by selecting a ZIP for backup import, bypassing client-side file-type verification, potentially leading to stored XSS or malw...
PT-2025-45378
Name of the Vulnerable Software and Affected Versions ThinkDashboard versions 0.6.7 and below Description ThinkDashboard, a self-hosted bookmark dashboard built with Go and vanilla JavaScript, has an issue where an attacker can upload arbitrary files to the '/data' directory of the web applicatio...
CVE-2025-64176: Improper Input Validation
ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish to the /data directory of the web application via the backup import feature. When importing a backup, an attacker can first choose a .zip...
EUVD-2025-29396
Malicious code in bioql PyPI...
CVE-2025-32779: Improper Limitation of a Pathname to a Restricted Directory
E.D.D.I Enhanced Dialog Driven Interface is a middleware to connect and manage LLM API bots. In versions before 5.5.0, an attacker with access to the /backup/import API endpoint can write arbitrary files to locations outside the intended extraction directory due to a Zip Slip vulnerability...
GHSA-CCJ3-5P93-8P42 SurrealDB server-takeover via SurrealQL injection on backup import
The SurrealDB command-line tool allows exporting databases through the export command. It was discovered that table or field names are not properly sanitized in exports, leading to a SurrealQL injection when the backup is reimported. For the injection to occur, an authenticated System User with...
CVE-2024-32876
NewPipe is an Android app for video streaming written in Java. It supports exporting and importing backups, as a way to let users move their data to a new device effortlessly. However, in versions 0.13.4 through 0.26.1, importing a backup file from an untrusted source could have resulted in...
VulnCheck KEV: CVE-2022-30075
In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validation...
CVE-2024-32876
CVE-2024-32876 concerns NewPipe (Android, Java) backups. In versions 0.13.4–0.26.1, importing a backup from an untrusted source could lead to Arbitrary Code Execution because the app deserializes backups via Java Object Serialization Stream Protocol. Attackers must craft a malicious backup and co...
NewPipe 安全漏洞
NewPipe is a Team NewPipe open source Android application written in Java for video streaming. A security vulnerability exists in NewPipe versions 0.13.4 through 0.26.1, which stems from the fact that importing a backup file from an untrusted source may result in arbitrary code execution...
CVE-2023-43825
Relative path traversal vulnerability in Shihonkanri Plus Ver9.0.3 and earlier allows a local attacker to execute an arbitrary code by having a legitimate user import a specially crafted backup file of the product...
Shihonkanri Plus Path Traversal Vulnerability
Ekakin Shihonkanri Plus GOOUT is a CGI Public Gateway Interface from Ekakin Japan. A path traversal vulnerability exists in Shihonkanri Plus Ver9.0.3 and earlier versions that could allow a local attacker to execute arbitrary code by allowing a legitimate user to import a specially crafted produc...
PT-2023-29002 · Unknown · Shihonkanri Plus
Name of the Vulnerable Software and Affected Versions: Shihonkanri Plus versions prior to 9.0.3 Description: A relative path traversal issue allows a local attacker to execute arbitrary code by having a legitimate user import a specially crafted backup file of the product. Recommendations: For...
