EUVD-2025-25508

Malicious code in bioql PyPI...

EUVD-2025-22745

Malicious code in bioql PyPI...

EUVD-2025-26368

Malicious code in bioql PyPI...

EUVD-2022-53042

Malicious code in bioql PyPI...

EUVD-2022-52960

Malicious code in bioql PyPI...

EUVD-2022-53030

Malicious code in bioql PyPI...

EUVD-2022-0110

Malicious code in bioql PyPI...

EUVD-2022-52994

Malicious code in bioql PyPI...

EUVD-2025-25747

Malicious code in bioql PyPI...

EUVD-2025-24553

Malicious code in bioql PyPI...

EUVD-2022-53039

Malicious code in bioql PyPI...

EUVD-2025-17754

Malicious code in bioql PyPI...

EUVD-2022-52974

Malicious code in bioql PyPI...

A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.

...

CVE-2025-8575: Absolute Path Traversal

The LWS Cleaner plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'lwscldeletefile' function in all versions up to, and including, 2.4.1.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to...

CVE-2025-9516: Absolute Path Traversal

The atec Debug plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.22 via the 'customlog' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to view the contents of files outside of the original...

MobSF Path Traversal in GET /download/<filename> using absolute filenames

Summary The GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWDDIR download directory from "neighboring" directories whose absolute paths begin with the same prefix as DWDDIR e.g., .../downloadsbak,...

GHSA-CCC3-FVFX-MW3V MobSF Path Traversal in GET /download/<filename> using absolute filenames

Summary The GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWDDIR download directory from "neighboring" directories whose absolute paths begin with the same prefix as DWDDIR e.g., .../downloadsbak,...

CVE-2025-58162 MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction

MobSF is a mobile application security testing tool used. In version 4.4.0, an authenticated user who uploaded a specially prepared one.a, can write arbitrary files to any directory writable by the user of the MobSF process. This issue has been patched in version 4.4.1...

CVE-2025-58162 MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction

MobSF is a mobile application security testing tool used. In version 4.4.0, an authenticated user who uploaded a specially prepared one.a, can write arbitrary files to any directory writable by the user of the MobSF process. This issue has been patched in version 4.4.1...