CVE-2025-36114

CVE-2025-36114 affects IBM QRadar SOAR Plugin App versions 1.0.0–5.6.0. The issue is a path traversal vulnerability: a remote attacker could send crafted URL requests containing “dot dot” sequences (/../) to view arbitrary files on the system. IBM’s security bulletin notes a fix in version 5.6.2;...

CVE-2025-55201 Copier safe template has arbitrary filesystem read/write access

Copier library and CLI app for rendering project templates. Prior to 9.9.1, a safe template can currently read and write arbitrary files because Copier exposes a few pathlib.Path objects in the Jinja context which have unconstrained I/O methods. This effectively renders the security model w.r.t...

CVE-2025-55201

CVE-2025-55201 concerns the Copier library/CLI used for rendering project templates. Prior to version 9.9.1, the template rendering context exposes certain pathlib.Path objects in Jinja with unconstrained I/O methods, enabling a safe template to read and write arbitrary files on the filesystem an...

PT-2025-33667

Name of the Vulnerable Software and Affected Versions: Copier versions prior to 9.9.1 Description: Copier exposes pathlib.Path objects in the Jinja context with unconstrained I/O methods, allowing a safe template to read and write arbitrary files. This renders the security model regarding...

PT-2025-33330 · Cisco · Cisco Secure Firewall Asa +1

Name of the Vulnerable Software and Affected Versions: Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software affected versions not specified Description: A vulnerability in the Remote Access SSL VPN service could allow an authenticate...

CVE-2025-34154

UnForm Server Manager versions prior to 10.1.12 expose an unauthenticated file read vulnerability via its log file analysis interface. The flaw resides in the arc endpoint, which accepts a fl parameter to specify the log file to be opened. Due to insufficient input validation and lack of path...

PT-2025-32651 · Siemens · Sinamics Starter +2

Name of the Vulnerable Software and Affected Versions: SIMOTION SCOUT TIA versions 5.4, 5.5, 5.6 through 5.6 SP1 HF6, and 5.7 through 5.7 SP1 HF0 SIMOTION SCOUT versions 5.4, 5.5, 5.6 through 5.6 SP1 HF6, and 5.7 through 5.7 SP1 HF0 SINAMICS STARTER versions 5.5, 5.6, and 5.7 Description: The...

CVE-2025-55149 Path Traversal Vulnerability in PDF Review Function (CWE-22)

Tiny-Scientist is a lightweight framework for automating the entire lifecycle of scientific research—from ideation to implementation, writing, and review. In versions 0.1.1 and below, a critical path traversal vulnerability has been identified in the reviewpaper function in backend/app.py. The...

CVE-2025-54254

Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files on the local file system, scope i...

CVE-2025-54254

Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files on the local file system, scope i...

The software of the centralized backup and disaster recovery management system of Dell PowerProtect Data Manager is vulnerable due to insufficient validation of input data. This allows attackers to read arbitrary files.

The vulnerability of the software for centralized backup and disaster recovery management in Dell PowerProtect Data Manager is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to read arbitrary files...

CVE-2025-54962

/edit-user in webserver in OpenPLC Runtime 3 through 9cd8f1b allows authenticated users to upload arbitrary files such as .html or .svg, and these are then publicly accessible under the /static URI...

Improper Validation of Specified Type of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the url validator in jdbc interpreter. An attacker can access arbitrary files on the system by submitting a specially crafted, non UTF-8 encoded JDBC connection string. Note: This issue...

CVE-2025-8213

The NinjaScanner – Virus & Malware scan plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'nscanajaxquarantine' and 'nscanquarantineselect' functions in all versions up to, and including, 3.2.5. This makes it possible for authenticated...

CVE-2013-10063 Netgear SPH200D <= 1.0.4.80 Path Traversal via HTTP GET

A path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions = 1.0.4.80 in its embedded web server. Authenticated attackers can exploit crafted GET requests to access arbitrary files outside the web root by injecting traversal sequences. This can expose sensitive...

CVE-2025-50184

DbGate is cross-platform database manager. In versions 6.4.3-premium-beta.5 and below, DbGate is vulnerable to a directory traversal flaw. The file parameter is not properly restricted to the intended uploads directory. As a result, the endpoint that lists files within the upload directory can be...

Apache Jena Input Validation Error Vulnerability

Apache Jena is the Apache Software Foundation's open source Java framework for building semantic web and linked data applications. A file path validation vulnerability exists in Apache Jena 5.4.0 and earlier versions, which stems from a failure to validate file access paths in configuration files...

CVE-2025-52168

Incorrect access control in the dynawebservice component of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows unauthenticated attackers to access arbitrary files on the system...

CVE-2025-52168

Incorrect access control in the dynawebservice component of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows unauthenticated attackers to access arbitrary files on the system...

Agorum core open 安全漏洞

Agorum core open is an enterprise content management system from Agorum Germany. A security vulnerability exists in Agorum core open versions prior to 11.9.2 and prior to 11.10.1, which stems from improper access control of the dynawebservice component and could lead to arbitrary file access...