CVE-2026-75594: Improper Limitation of a Pathname to a Restricted Directory

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache...

Cross-Site Scripting (XSS)

craftcms/cms is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of user-input sanitization in Craft parameter of Asset.php which allows an attacker to inject and execute arbitrary JavaScript into the browser...

CVE-2021-38290: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuelconstants.php and fuel/modules/fuel/libraries/Asset.php. An attacker can use a man in the middle attack such as phishing...

PT-2021-3961

Name of the Vulnerable Software and Affected Versions FUEL CMS versions 1.5.0 Description A host header attack issue exists due to the lack of special element neutralization in fuel/modules/fuel/config/fuel constants.php and fuel/modules/fuel/libraries/Asset.php. This can allow a remote attacker ...

CVE-2018-5283

The Photos in Wifi application 1.0.1 for iOS has directory traversal via the ext parameter to assets-library://asset/asset.php...

CVE-2018-5283: Improper Limitation of a Pathname to a Restricted Directory

The Photos in Wifi application 1.0.1 for iOS has directory traversal via the ext parameter to assets-library://asset/asset.php...

PT-2018-16864

Name of the Vulnerable Software and Affected Versions Photos in Wifi application version 1.0.1 Description The issue concerns directory traversal in the Photos in Wifi application. It is possible to exploit this via the ext parameter to access files outside the intended directory, specifically...