CVE-2024-7626

The WP Delicious – Recipe Plugin for Food Bloggers formerly Delicious Recipes plugin for WordPress is vulnerable to arbitrary file movement and reading due to insufficient file path validation in the saveeditprofiledetails function in all versions up to, and including, 1.6.9. This makes it possib...

CVE-2024-21549

Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file. Note:...

CVE-2024-3429

A path traversal vulnerability exists in the parisneo/lollms application, specifically within the sanitizepathfromendpoint and sanitizepath functions in lollmscore\lollms\security.py. This vulnerability allows for arbitrary file reading when the application is running on Windows. The issue arises...

CVE-2024-48931

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the ZimaOS API endpoint http:///v3/file?token== is vulnerable to arbitrary file reading due to improper input validation. By manipulating the files parameter,...

BIT-MLFLOW-2024-3573 Local File Inclusion (LFI) via Scheme Confusion in mlflow/mlflow

mlflow/mlflow is vulnerable to Local File Inclusion LFI due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'islocaluri' function's failure to properly handle URIs with empty or 'file' schemes, leading to the...

CVE-2024-57252

OtCMS =V7.46 is vulnerable to Server-Side Request Forgery SSRF in /admin/read.php, which can Read system files arbitrarily...

WAVLINK AC3000 Path Traversal Vulnerability

WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. The WAVLINK AC3000 suffers from a path traversal vulnerability, which stems from the failure of the adddirname parameter of the nas.cgi adddir function to correctly filter special elements in the path of a resource or file. An attacke...

CVE-2024-35532

An XML External Entity XXE injection vulnerability in Intersec Geosafe-ea 2022.12, 2022.13, and 2022.14 allows attackers to perform arbitrary file reading under the privileges of the running process, make SSRF requests, or cause a Denial of Service DoS via unspecified vectors...

CVE-2024-35532

An XML External Entity XXE injection vulnerability in Intersec Geosafe-ea 2022.12, 2022.13, and 2022.14 allows attackers to perform arbitrary file reading under the privileges of the running process, make SSRF requests, or cause a Denial of Service DoS via unspecified vectors...

CVE-2024-35532

Intersec Geosafe-ea versions 2022.12, 2022.13, and 2022.14 contain an XML External Entity (XXE) injection vulnerability. The flaw allows an attacker to read arbitrary files with the running process’s privileges, initiate SSRF requests, or cause a Denial of Service through unspecified vectors. The...

CVE-2024-21549

Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file. Note: This...

CVE-2024-21549

The vulnerability concerns spatie/browsershot prior to 5.0.5. Improper URL validation in setUrl allows Local File Inclusion via view-source:file://, expanding a known bypass of CVE-2024-21549. Affected versions are before 5.0.5; remediation is to upgrade to 5.0.5 or newer to mitigate the issue.

CVE-2024-21549

Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file. Note: This...

CVE-2024-8058

An improper parsing vulnerability was reported in the FileZ client that could allow a crafted file in the FileZ directory to read arbitrary files on the device due to URL preloading...

CVE-2024-10708

CVE-2024-10708 affects the WordPress System Dashboard plugin prior to version 2.8.15. The vulnerability arises from unvalidated input used in a path (via the sd_viewer action’s filename parameter), enabling authenticated administrators to perform path traversal and read arbitrary server files (e....

CVE-2024-11978 Interinfo DreamMaker - Arbitrary File Reading through Path Traversal

DreamMaker from Interinfo has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files...

CVE-2024-11978

CVE-2024-11978 affects DreamMaker from Interinfo and is described as a Path Traversal vulnerability that allows unauthenticated remote attackers to read arbitrary system files. The initial entry notes a CVSS v3.1 base score of 7.5 (Network, Privileges None, User Interaction None, Confidentiality ...

CVE-2024-11978 Interinfo DreamMaker - Arbitrary File Reading through Path Traversal

DreamMaker from Interinfo has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files...

TRCore DVC Path Traversal Vulnerability

TRCore DVC is a file insurance system from TRCore China. TRCore DVC suffers from a path traversal vulnerability that stems from the program's failure to properly filter special elements in the path of a resource or file, which can be exploited by an attacker to read arbitrary system files...

CVE-2024-11067 D-Link DSL6740C - Arbitrary File Reading through Path Traversal

The D-Link DSL6740C modem has a Path Traversal Vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. Additionally, since the device's default password is a combination of the MAC address, attackers can obtain the MAC address through...