CVE-2026-18903

A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This issue affects some unknown processing of the file src/main/java/com/yeqifu/sys/controller/FileController.java. This manipulation of the argument path causes path traversal. It is possible to...

CVE-2026-16940

The CVE-2026-16940 affects the Custom Fields WordPress plugin (often listed as Custom Fields for WooCommerce) before version 1.5.1. The root cause is that the plugin does not validate a user-supplied file path before deletion, enabling unauthenticated users to delete arbitrary server files (e.g.,...

CVE-2026-16940 Custom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal

The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server such as wp-config.php, which can lead to a full site takeover...

EUVD-2026-53097

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extnamefilename and passes it, unescaped, into a...

EUVD-2026-53047

A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This issue affects some unknown processing of the file src/main/java/com/yeqifu/sys/controller/FileController.java. This manipulation of the argument path causes path traversal. It is possible to...

CVE-2026-18903 yeqifu warehouse FileController.java path traversal

A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This issue affects some unknown processing of the file src/main/java/com/yeqifu/sys/controller/FileController.java. This manipulation of the argument path causes path traversal. It is possible to...

CVE-2026-18903

CVE-2026-18903 affects the yeqifu warehouse. The issue is a path traversal in the FileController.java (src/main/java/com/yeqifu/sys/controller/FileController.java), caused by manipulation of the input path. This could allow remote initiation. Public disclosures exist. No exact vulnerable versions...

CVE-2026-18903

A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This issue affects some unknown processing of the file src/main/java/com/yeqifu/sys/controller/FileController.java. This manipulation of the argument path causes path traversal. It is possible to...

CVE-2026-66839

NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability CWE-428. An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges...

EUVD-2026-53044

NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability CWE-428. An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges...

CVE-2026-66839

NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability CWE-428. An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges...

CVE-2026-66839

CVE-2026-66839 concerns NetKids iMark from Integrated Systems Technologies, Inc., with an Unquoted Search Path or Element (CWE-428). The issue allows an authenticated attacker to execute arbitrary code with SYSTEM privileges via a local attack vector. Affected software is specified as NetKids iMa...

CVE-2026-66344

Technical details are not publicly available in the provided documents. Monitor for updates on CVE-2026-66344.

CVE-2026-66344

NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled Search Path Element vulnerability CWE-427. An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges...

CVE-2026-66344

NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled Search Path Element vulnerability CWE-427. An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges...

CVE-2026-66344

NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled Search Path Element vulnerability CWE-427. An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges...

EUVD-2026-53043

NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled Search Path Element vulnerability CWE-427. An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges...

CVE-2026-18907

Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename...

CVE-2026-18907

Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename...

CVE-2026-18907

CVE-2026-18907 affects com.talpa.hibrowser on Android (version 2.23.1.1). The vulnerability occurs in the Download File feature, where directory traversal sequences in the filename enable arbitrary file write. Documented impact is high (CVSS 7.5) with no disclosed exploitation details in the prov...