EUVD-2023-23335

Malicious code in bioql PyPI...

PT-2025-31821 · Unknown +1 · Iis-K3Cloudminiapp +1

Name of the Vulnerable Software and Affected Versions: Kingdee Cloud-Starry-Sky Enterprise Edition versions prior to 8.2 Description: A path traversal issue exists in the BaseServiceFactory.getFileUploadService.deleteFileAction function within the...

CVE-2025-7452

A vulnerability was found in kone-net go-chat up to f9e58d0afa9bbdb31faf25e7739da330692c4c63. It has been declared as critical. This vulnerability affects the function GetFile of the file go-chat/api/v1/filecontroller.go of the component Endpoint. The manipulation of the argument fileName leads t...

CVE-2025-6853

CVE-2025-6853 affects the Langchain-Chatchat backend component in the project "chatchat-space" up to version 0.3.1. The vulnerability is in the function upload_temp_docs under /knowledge_base/upload_temp_docs, where manipulating the flag argument enables a path traversal. The issue can be exploit...

The vulnerability of the SSLVPN microprogramming system for network interfaces from SonicWall SMA 100 allows a hacker to bypass security restrictions.

The vulnerability of the SSLVPN microprogramming system for network interfaces from SonicWall SMA 100 relates to an incorrect restriction on the path name to the restricted access directory. Exploiting this vulnerability could allow a malicious actor to bypass security restrictions remotely...

CVE-2025-33035

A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: File Station 5...

CVE-2024-2863

This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant...

CVE-2022-23135

There is a directory traversal vulnerability in some home gateway products of ZTE. Due to the lack of verification of user modified destination path, an attacker with specific permissions could modify the FTP access path to access and modify the system path contents without authorization, which...

CVE-2021-37105

There is an improper file upload control vulnerability in FusionCompute 6.5.0, 6.5.1 and 8.0.0. Due to the improper verification of file to be uploaded and does not strictly restrict the file access path, attackers may upload malicious files to the device, resulting in the service abnormal...

PT-2025-20654 · Shanghai Bairui Information Technology · Sunloginclient

Name of the Vulnerable Software and Affected Versions: Shanghai Bairui Information Technology SunloginClient version 15.8.3.19819 Description: A critical vulnerability has been found in the library process.dll of the file sunlogin guard.exe, affecting an unknown part. The manipulation leads to an...

CVE-2025-20949

Path traversal vulnerability in Samsung Members prior to version 5.0.00.11 allows attackers to read and write arbitrary file with the privilege of Samsung Members...

CVE-2025-3381 zhangyanbo2007 youkefu File Upload WebIMController.java path traversal

A vulnerability, which was classified as critical, was found in zhangyanbo2007 youkefu 4.2.0. This affects an unknown part of the file WebIMController.java of the component File Upload. The manipulation of the argument ID leads to path traversal. It is possible to initiate the attack remotely. Th...

PT-2025-10797 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to the improper resolution of path equivalence in Windows MapUrlToZone, which allows an unauthorized attacker to bypass a security feature over a network. This could...

ZKTeco ZKBio Time 安全漏洞

ZKTeco ZKBio Time is a powerful web-based time and attendance management software from ZKTeco, China. A security vulnerability exists in ZKTeco ZKBio Time version 9.0.1, which originates from the component Image File Handler where the file /authfiles/photo/ can lead to a direct request...

Exploit for Code Injection in Vmware Spring_Cloud_Data_Flow

Detect vulnerabilities First, Use dnslog to detect whether CV...

CVE-2024-46858 mptcp: pm: Fix uaf in __timer_delete_sync

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: Fix uaf in timerdeletesync There are two paths to access mptcppmdeladdtimer, result in a race condition: CPU1 CPU2 ==== ==== netrxaction napipoll netlinksendmsg napipoll netlinkunicast processbacklog netlinkunicastkern...

CVE-2024-47170 Agnai File Disclosure Vulnerability: JSON via Path Traversal

Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to read arbitrary JSON files at attacker-chosen locations on the server. This issue can lead to unauthorized access to sensitive information an...

The vulnerability of the programming software for PLCs (programmable logic controllers), namely the Saia PG5 Controls Suite, arises from incorrect restrictions on the path name to the restricted access directory. This vulnerability allows a perpetrator to execute arbitrary code.

The vulnerability of the programming software for PLCs programmable logic controllers, Saia PG5 Controls Suite, is related to incorrect restrictions on the path name to the restricted access directory when processing CAB format files. Exploiting this vulnerability allows an attacker to execute...

The vulnerability of the software development environment of Totally Integrated Automation Portal (Portal TIA) relates to the possibility of bypassing the path, allowing a intruder to execute arbitrary code.

The vulnerability of the Totally Integrated Automation Portal Portal TIA software development environment relates to the possibility of bypassing the access path. Exploiting this vulnerability allows an attacker to execute arbitrary code, provided that the user opens a specially crafted...

The vulnerability of FortiWeb web applications’ network firewalls arises from incorrect restrictions on the path to the restricted access catalog, allowing attackers to gain unauthorized access to protected information.

The vulnerability of FortiWeb web applications’ network firewalls is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through a special...