CVE-2024-55926

A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data...

The vulnerability of the Mitel MiCollab collaboration platform, related to an incorrect restriction on the path name to the restricted access catalog, allows a hacker to read arbitrary files.

The vulnerability of the Mitel MiCollab collaboration platform lies in an incorrect restriction on the path name used to access the restricted catalog. Exploiting this vulnerability could allow an attacker to read arbitrary files...

Arbitrary File Read

org.apache.linkis, linkis-metadata-query-service-jdbc is vulnerable to Arbitrary File Read. The vulnerability is due to insufficient parameter filtering in the DataSource Manager Module, allowing an attacker to configure malicious MySQL JDBC parameters to read arbitrary files from the server...

CVE-2024-10799 Eventer <= 3.9.7 - Authenticated (Subscriber+) Arbitrary File Read

The Eventer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.9.7 via the eventerwoodownloadtickets function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the...

CVE-2024-10799 Eventer <= 3.9.7 - Authenticated (Subscriber+) Arbitrary File Read

The Eventer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.9.7 via the eventerwoodownloadtickets function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the...

CVE-2024-10799

CVE-2024-10799: Eventer (WordPress Event & Booking Manager Plugin)

WordPress Eventer plugin <= 3.9.7 - Authenticated (Subscriber+) Arbitrary File Read vulnerability

Authenticated Subscriber+ Arbitrary File Read vulnerability discovered by Tonn in WordPress Plugin Eventer versions = 3.9.7...

Exploit for CVE-2025-25599

CVE-2025-25599 Details Bolt is an o...

Zenitel AlphaWeb XE 安全漏洞

Zenitel AlphaWeb XE is an embedded web server from Zenitel running on AlphaCom XE. A security vulnerability exists in Zenitel AlphaWeb XE version v11.2.3.10. An attacker can exploit the vulnerability to read arbitrary files on the application service...

CVE-2025-0474

Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery SSRF allowing for arbitrary file read and network resource requests as the application user. This issue affects Invoice Ninja: from 5.8.56 through 5.11.23...

CVE-2025-0474 Invoice Ninja PDF Rendering Server Side Request Forgery

Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery SSRF allowing for arbitrary file read and network resource requests as the application user. This issue affects Invoice Ninja: from 5.8.56 through 5.11.23...

PT-2025-3907 · Unknown · Invoice Ninja

Name of the Vulnerable Software and Affected Versions: Invoice Ninja versions 5.8.56 through 5.11.23 Description: Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery SSRF, allowing for arbitrary file read and network resource requests as the application user. This issue enabl...

Exploit for Improper Check for Unusual or Exceptional Conditions in Jenkins

Intro This is an exploit for CVE-2024-43044, an arbitrary fil...

CVE-2024-9939 WordPress File Upload <= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php

The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.13 via wfufiledownloader.php. This makes it possible for unauthenticated attackers to read files outside of the originally intended directory...

CVE-2024-11613

The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to, and including, 4.24.15 via the 'wfufiledownloader.php' file. This is due to lack of proper sanitization of the 'source' parameter and...

CVE-2024-11613

The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to, and including, 4.24.15 via the 'wfufiledownloader.php' file. This is due to lack of proper sanitization of the 'source' parameter and...

CVE-2024-11613 WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion

The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to, and including, 4.24.15 via the 'wfufiledownloader.php' file. This is due to lack of proper sanitization of the 'source' parameter and...

CVE-2024-11613

The CVE CVE-2024-11613 affects the WordPress File Upload plugin for WordPress, with vulnerable versions up to and including 4.24.15. The flaw arises from insufficient sanitization of the source parameter in wfu_file_downloader.php, allowing an unauthenticated attacker to specify a user-controlled...

CVE-2024-11613 WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion

The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to, and including, 4.24.15 via the 'wfufiledownloader.php' file. This is due to lack of proper sanitization of the 'source' parameter and...

WordPress WordPress File Upload plugin <= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php vulnerability

Unauthenticated Path Traversal to Arbitrary File Read in wfufiledownloader.php vulnerability discovered by abrahack in WordPress Plugin WordPress File Upload versions = 4.24.13...