334240 matches found
CVE-2026-119145 Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload
Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achiev...
CVE-2026-119145
The Frappe platform (versions before 15.121.0 and 16.x before 16.34.0 ) is vulnerable to a path traversal vulnerability. The root cause is that certain file-upload handling mechanisms fail to validate the destination path before writing to the disk. This allows authenticated attackers to upload c...
CVE-2026-119145 Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload
Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achiev...
EUVD-2026-113212
Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achiev...
CVE-2026-90866
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows are affected by a path traversal vulnerability. This flaw allows a delegated Host Administrator to bypass virtual folder path confinement and access locations outside their authorized scope, which could potentially...
EUVD-2026-113023
A path traversal vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution...
CVE-2026-90866 Virtual Folder Path Confinement Bypass in Progress WS_FTP Server
A path traversal vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution...
cve-2024-4577-lab
CVE-2024-4577 — PHP-CGI Argument Injection → RCE Docker Lab / CTF A self-contained, from-scratch Docker lab that demonstrates the real argument-injection → Remote Code Execution primitive behind CVE-2024-4577. Exploit it over http://localhost:8080, pop a shell, and read the flag from inside the...
CVE-2026-42167
CVE-2026-42167: SQL Injection in ProFTPD modsql 📋 Executive Summary CVE-2026-42167 is a critical SQL injection vulnerability in ProFTPD's modsql module that allows authentication bypass , backdoor user injection , and remote code execution RCE. Attribute| Value ---|--- Type| SQL Injection CWE-89...
CVE-2026-61991
The AjaxLoadMore Cache WordPress plugin versions
CVE-2026-61991 WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution RCE in AjaxLoadMore Cache = 3.1.1 versions...
CVE-2026-18894
IBM Langflow OSS versions 1.0.0 through 1.12.4 are vulnerable to a code injection flaw (CWE-94 ). A remote attacker can trigger pre-existing stored Python component code within a public workflow, executing it under the flow owner's runtime context. This bypasses the trust boundary intended to res...
CVE-2026-18894 Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are...
EUVD-2026-113144
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data...
CVE-2026-104317
IBM Langflow OSS versions 1.0.0 through 1.12.3 are vulnerable to a Remote Code Execution (RCE) flaw. A remote attacker who can reach the message broker can execute arbitrary code on the system by exploiting the deserialization of untrusted data . No specific remediation steps or exploit links are...
CVE-2026-104317 Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data...
CVE-2026-104339 Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...
CVE-2026-104339
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...
CVE-2026-104339
Langflow OSS versions 1.0.0 through 1.12.3 are affected by a critical code injection vulnerability (CVE-2026-104339). The flaw stems from the improper neutralization of special elements used in an OS command, which could allow a remote attacker to execute arbitrary code . The impact is significan...