The vulnerability of the platform for creating individual web applications in CRM involves an incorrect restriction on the path to the catalog, allowing attackers to delete arbitrary files.

The vulnerability of the platform for creating individual web applications in CRM involves incorrect restrictions on the path to the catalog. Exploiting this vulnerability could allow a malicious actor to delete arbitrary files remotely...

The vulnerability of the Webasyst content management framework and the Shop-Script CMS system lies in improper restrictions on path names to the catalog. This allows attackers to gain unauthorized access to local files and directories.

The vulnerability of the Webasyst content management framework and the Shop-Script CMS system lies in incorrect restrictions on the path to the catalog. Exploiting this vulnerability can allow an attacker to gain unauthorized access to local files and directories on the server...

The vulnerability of the FOQUZ platform, related to incorrect restrictions on the name of the path to the catalog, allows attackers to compromise the integrity of the protected information.

The vulnerability of the FOQUZ platform is related to an incorrect limitation on the name of the path to the catalog. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected information...

The vulnerability of the FOQUZ platform, related to incorrect restrictions on path names in the catalog, allows attackers to compromise the accessibility of protected information.

The vulnerability of the FOQUZ platform is related to an incorrect limitation on the name of the path to the catalog. Exploiting this vulnerability could allow a malicious actor to compromise the accessibility of the protected information...

The vulnerability of the iFlightDoc onboard documentation system, related to incorrect restrictions on the path name to the catalog, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the iFlightDoc onboard documentation system is related to an incorrect limitation on the name of the path to the catalog h. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the protected information...

The vulnerability of the Enlogic SCADA system’s virtual controller “ENTEK” arises from incorrect restrictions on the path name to the catalog, allowing a intruder to write arbitrary files.

The vulnerability of the Enlogic SCADA system “ENTEK”’s virtual controller is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability allows a malicious actor to write arbitrary files...

EUVD-2026-91675

uv: Path traversal on Windows through wheel extraction...

GHSA-2CV4-CQWR-GWF7 uv: Path traversal on Windows through wheel extraction

Impact In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present o...

EUVD-2026-90363

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup...

EUVD-2026-91761

Nx: Path traversal in nx migrate package-migrations extraction...

GHSA-7G7C-H8RR-7P6Q Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

A Path Traversal vulnerability exists in the prerendered SSG page retrieval logic of CommonEngine in @angular/ssr/node and @angular/ssr in earlier versions. When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serv...

EUVD-2026-92815

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocumentbackend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced pa...

CVE-2026-105748

The Docling library (versions 2.16.0 through 2.131.0 ) is vulnerable because the InputFormat.JSON_DOCLING backend fails to reject picture image references containing local paths or file URIs during serialized DoclingDocument input validation. When processing with ImageRefMode.EMBEDDED , the Docli...

CVE-2026-102262 Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control

Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code...

CVE-2026-102262

Newell Brands DYMO ID version 1.5.1.71 is vulnerable to a path traversal issue due to improper spheres of control. The software resolves its plugin Modules directory relative to the process working directory. An attacker can place a malicious job file and DLLs in a directory, then set the process...

CVE-2026-105766

The Chainguard Academy (edu) website is vulnerable to an HTTPS to HTTP downgrade attack due to the use of the backend-facing $scheme variable in the nginx.conf trailing-slash directory redirect. This issue exists in versions from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0...

CVE-2026-105683

The Ghost Node.js content management system is vulnerable to a path traversal vulnerability (CWE-35) in the ImageSize Service . Affected versions range from 6.14.0 until 6.27.0 . Due to an input validation issue, authenticated staff users could access local files outside of the intended data stor...

CVE-2026-105676

Ghost, a Node.js content management system , is vulnerable to a path traversal flaw in how it loads theme translation files. Affected versions range from 1.20.0 until 6.64.0 . An authenticated Administrator can exploit this vulnerability to read JSON files outside of the active theme's directory,...

CVE-2025-30208-PoC

면책 조항: 본 문서에서 설명하는 취약점 및 재현 절차는 오직 사이버 보안 연구 및 교육 목적으로 제공됩니다. 본 문서의 정보를 불법 목적이나 승인되지 않은 시스템 테스트에 사용해서는 안 됩니다. 작성자는 본 문서의 정보 사용으로 인해 발생하는 직간접적 손해에 대해 책임을 지지 않습니다. 인용 시 출처를 명시해 주세요! 펀촨 주소: https://pc.fenchuan8.com//index?forum=101158&yqm=DGR4X usage: vitecheck.py -h -f FILE -u URL -p PAYLOAD --prox...

CVE-2025-31131

CVE-2025-31131 - YesWiki 4.5.2 미만 경로 탐색 익스플로잇 이것은 YesWiki 4.5.2 이전 버전을 대상으로 하는 인증되지 않은 경로 탐색 익스플로잇입니다. 취약점은 squelette 매개변수에 존재하며, 서버에서 임의의 파일을 읽을 수 있게 합니다. 취약점 세부 정보 CVE-ID: CVE-2025-31131 영향 받는 소프트웨어: YesWiki 4.5.2 미만 유형: 경로 탐색 심각도: 높음 CVSS: 8.6 참조:...