133405 matches found
CVE-2026-87727
a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the affected product...
CVE-2026-87727
a-blog cms (by appleple inc.) versions 3.2.33 and earlier contain a path traversal vulnerability (CWE-22) that allows a remote unauthenticated attacker to read or delete arbitrary files on the server. The vulnerability is only exploitable when the form setting "Attaching files to emails addressed...
EUVD-2026-76020
a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the affected product...
CVE-2026-88046
A flaw was found in rclone, a command-line program for syncing files. This vulnerability allows an attacker to bypass configured directory restrictions by including parent-directory segments e.g., '..' in source object names. When a specially crafted source object is uploaded or copied, it can...
a-blog cms vulnerable to path traversal
Overview a-blog cms provided by appleple inc. contains the following vulnerability. Path traversal CWE-22 - CVE-2026-87727 You are affected by this vulnerability only when "Attaching files to emails addressed to the administrator" is enabled in the form settings. hibiki moriyama of STNet,...
CVE-2026-19991
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...
EUVD-2026-75939
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...
CVE-2026-19991
CVE-2026-19991 affects the UsersWP WordPress plugin in versions up to and including 1.2.70 , allowing authenticated attackers with Subscriber-level access or higher to perform arbitrary file deletion via the upload_file_remove() AJAX handler. The root cause lies in a validation bypass: the plugin...
CVE-2026-19991 UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...
CVE-2026-19991 UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...
EUVD-2026-75761
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...
EUVD-2026-75764
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability...
EUVD-2026-75889
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the username Parameter. This makes it possible for unauthenticated attackers to read the conten...
EUVD-2026-75770
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability...
EUVD-2026-75772
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability...
EUVD-2026-75773
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrarily write to or delete files on shared storage due to a path traversal vulnerability...
EUVD-2026-75782
IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs...
EUVD-2026-75787
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction...