Gradio - Absolute Path Traversal

Gradio 6.7 on Windows with Python 3.13+ contains an absolute path traversal caused by incorrect path validation in path joining logic, letting unauthenticated attackers read arbitrary files from the server. id: CVE-2026-28414 info: name: Gradio - Absolute Path Traversal author: 0xAkoko severity:...

VulnCheck KEV: CVE-2026-28414

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path traversal issue that enables unauthenticated attackers to read arbitrary files from the file system. Python 3.13+ change...

CVE-2026-28414

creationtimestamp| type| source ---|---|--- 2026-02-27 20:22:53+00:00| published-proof-of-concept| https://github.com/gradio-app/gradio/security/advisories/GHSA-39mp-8hj3-5c49 2026-02-28 00:28:18+00:00| published-proof-of-concept| https://t.me/realcodeb0ss/348 2026-02-28 05:01:30+00:00| seen|...

CVE-2020-28414

A reflected cross-site scripting XSS vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url different vector than CVE-2020-28415...

CVE-2023-28414

creationtimestamp| type| source ---|---|--- 2023-05-12 20:27:05+00:00| seen| https://t.me/cibsecurity/64042...

CVE-2023-28414

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in ApexChat plugin = 1.3.1 versions...

CVE-2023-28414

CVE-2023-28414 : Stored XSS in the WordPress ApexChat plugin, affected versions ≤ 1.3.1. Exploitation requires admin+ privileges and authenticated access. Root cause reported elsewhere involves insufficient sanitization/escaping in plugin settings. A fix is available in version 1.3.2 (update from...

WordPress ApexChat Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

Software ApexChat Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28414 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID bedc3e47ac72 Credits Yuki Haruma Required privilege...

CVE-2022-28414

Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=deletemember...

CVE-2022-28414

CVE-2022-28414 affects Home Owners Collection Management System v1.0, with a SQL injection vulnerability in /hocms/classes/Master.php?f=delete_member. Root cause: improper input handling enabling SQL injection. Impact: potential disclosure/alteration of database data; per NVD, CVSSv3.1 base score...

CVE-2020-28414

creationtimestamp| type| source ---|---|--- 2020-11-12 22:32:13+00:00| seen| https://t.me/cibsecurity/16266 2020-11-12 22:32:15+00:00| seen| https://t.me/cibsecurity/16268...

Cross site scripting

A reflected cross-site scripting XSS vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url different vector than CVE-2020-28414...

CVE-2020-28414

CVE-2020-28414 describes a reflected XSS in Compassplus TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker can trigger arbitrary HTML code via a crafted URL, as per the NVD entry. Connected records also associate a related CVE-2020-28415. The root cause and exact exploit deta...