Lucene search
+L

7330 matches found

EUVD
EUVD
added 2026/08/21 12:14 p.m.3 views

EUVD-2026-63938

Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files...

7CVSS5.6AI score
SaveExploits0References1
CVE
CVE
added 2026/08/21 12:14 p.m.8 views

CVE-2026-75115

YOOtheme Pro (a Joomla extension by yootheme.com) versions 2.3.0 through 5.0.40 are affected by an authenticated arbitrary file read vulnerability. The root cause is that the Filesystem source's path filter is vulnerable to glob-based pattern attacks , allowing authorized users with privileged ac...

7CVSS5.6AI score
SaveExploits0References1
Patchstack
Patchstack
added 2026/08/21 7:59 a.m.4 views

WordPress Simple File List plugin <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal vulnerability

Unauthenticated Arbitrary File Read and Move via Path Traversal vulnerability discovered by Sanjar Tulkinov in WordPress Plugin Simple File List versions = 6.3.11...

8.6CVSS5.3AI score0.00543EPSS
SaveExploits0References1Affected Software1
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.181 views

Hoverfly < 1.10.3 - Arbitrary File Read

Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary...

7.5CVSS5.5AI score0.5585EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.60 views

Lightdash version <= 0.510.3 Arbitrary File Read

packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension .csv or .png is used. id: CVE-2023-35844 info: name: Lightdash version = 0.510.3 Arbitrary File Read author: dwisiswant0...

7.5CVSS7.4AI score0.06344EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.77 views

Mlflow < 2.11.0 - Path Traversal

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '' character can be used to insert a path into the fragment, effectively...

7.5CVSS7.5AI score0.43284EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.13 views

Microweber CMS <= 2.0.20 - Unauthenticated Arbitrary File Read

Microweber CMS = 2.0.20 contains a path traversal vulnerability caused by failure to normalize path query parameter in static file controller, letting unauthenticated remote attackers read arbitrary files. id: CVE-2026-65694 info: name: Microweber CMS = 2.0.20 - Unauthenticated Arbitrary File Rea...

8.7CVSS5.5AI score0.02456EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.33 views

Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Arbitrary File Read

The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wpajaxnoprivelvwplogdownload AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, whi...

7.5CVSS8.2AI score0.46858EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.4 views

Planyo Online Reservation System <= 3.0 - Arbitrary File Read

The Planyo Online Reservation System plugin for WordPress through 3.0 ships ulap.php, an AJAX proxy that is directly reachable without WordPress bootstrapping or authentication. The sendhttppost function validates the host of the supplied URL against an allowlist that includes localhost, but neve...

7.2CVSS5.6AI score0.02005EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.8 views

Nezha Dashboard < 2.0.13 - Path Traversal

Nezha Monitoring 2.0.13 contains a path traversal caused by improper prefix checking in the dashboard's NoRoute handler, letting unauthenticated attackers read arbitrary files via crafted URLs. id: CVE-2026-53519 info: name: Nezha Dashboard 2.0.13 - Path Traversal author: Aryu-RU,str4k3r severity...

9.1CVSS8.9AI score0.01852EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.7 views

Audiobookshelf - Authentication Bypass

Audiobookshelf contains a path traversal caused by improper authentication-exemption check on URL-encoded paths in server/routers/Auth.js, letting unauthenticated attackers read arbitrary files, exploit requires crafted URL with encoded traversal sequences. id: CVE-2026-71209 info: name:...

7.5CVSS5.4AI score0.0176EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.44 views

Java-springboot-codebase 1.1 - Arbitrary File Read

OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized...

8.7CVSS8.5AI score0.04053EPSS
SaveExploits29References5
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.123 views

CrateDB Database - Arbitrary File Read

CrateDB is a distributed SQL database that makes it simple to store and analyze massive amounts of data in real-time. There is a COPY FROM function in the CrateDB database that is used to import file data into database tables. This function has a flaw, and authenticated attackers can use the COPY...

6.5CVSS6.8AI score0.03084EPSS
SaveExploits1
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.28 views

OfficeWeb365 Indexs Interface - Arbitrary File Read

There is any file reading in the officeWeb365 Indexs interface. id: CVE-2024-37728 info: name: OfficeWeb365 Indexs Interface - Arbitrary File Read author: DhiyaneshDK severity: high description: | There is any file reading in the officeWeb365 Indexs interface. impact: | Unauthenticated attackers...

7.5CVSS5.2AI score0.01852EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.146 views

Vendure - Arbitrary File Read

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

9.1CVSS8.8AI score0.60429EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.119 views

Bazarr < 1.4.3 - Arbitrary File Read

Bazarr 1.4.3 and earlier versions have a arbitrary file read vulnerability. id: CVE-2024-40348 info: name: Bazarr Bazarr" - 'content="Bazarr' - "window.Bazarr" condition: or internal: true - method: GET path: - "BaseURL/api/swaggerui/static/../../../../../../../../../../../../../../../../etc/pass...

8.2CVSS9AI score0.0829EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.52 views

ShokoServer System - Local File Inclusion (LFI)

ShokoServer is a media server which specializes in organizing anime. In affected versions the /api/Image/WithPath endpoint is accessible without authentication and is supposed to return default server images. The endpoint accepts the parameter serverImagePath, which is not sanitized in any way...

8.6CVSS8.8AI score0.08147EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.153 views

WordPress Responsive Vector Maps < 6.4.2 - Arbitrary File Read

WordPress Responsive Vector Maps 6.4.2 contains an arbitrary file read vulnerability because the plugin does not have proper authorization and validation of the rvmuploadregionsfilepath parameter in the rvmimportregions AJAX action, allowing any authenticated user to read arbitrary files on the w...

6.5CVSS6.6AI score0.03089EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.361 views

Vite - Arbitrary File Read

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. @fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it...

7.5CVSS6.5AI score0.74784EPSS
SaveExploits28References2
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.63 views

Pichome 2.1.0 - Arbitrary File Read

A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed t...

6.9CVSS5.9AI score0.01628EPSS
SaveExploits0References2
Rows per page
Query Builder