Codex has sandbox bypass due to bug in path configuration logic

Due to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where the user started their session. This logic bypassed the intended workspace boundary and enables arbitrary file writes and comman...

CVE-2010-20121

CVE-2010-20121 affects EasyFTP Server up to version 1.7.0.11. It describes a stack-based buffer overflow in the FTP CWD command parser, allowing remote code execution without authentication due to anonymous access by default. The flaw’s root cause is improper input length validation for CWD, lead...

CVE-2010-20121: Stack-based Buffer Overflow

EasyFTP Server versions up to 1.7.0.11 contain a stack-based buffer overflow vulnerability in the FTP command parser. When processing the CWD Change Working Directory command, the server fails to properly validate the length of the input string, allowing attackers to overwrite memory on the stack...

CVE-2025-54794

Claude Code is an agentic coding tool. In versions below 0.2.111, a path validation flaw using prefix matching instead of canonical path comparison, makes it possible to bypass directory restrictions and access files outside the CWD. Successful exploitation depends on the presence of or ability t...

Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access

Due to a path validation flaw using prefix matching instead of canonical path comparison, it was possible to bypass directory restrictions and access files outside the CWD. Successful exploitation depends on the presence of or ability to create a directory with the same prefix as the CWD and the...

CVE-2025-28971

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CWD Web Designer Easy Elements Hider easy-elements-hider allows Stored XSS.This issue affects Easy Elements Hider: from n/a through = 2.0...

CVE-2025-28971

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CWD Web Designer Easy Elements Hider easy-elements-hider allows Stored XSS.This issue affects Easy Elements Hider: from n/a through = 2.0...

CVE-2025-28971

CVE-2025-28971 concerns the WordPress plugin Easy Elements Hider, where stored XSS is possible due to improper neutralization of input during web page generation. Affected: Easy Elements Hider versions up to 2.0 (no public fixed version details provided in the supplied documents). Impact is store...

PT-2025-27881 · Cwd · Cwd Web Designer Easy Elements Hider

Name of the Vulnerable Software and Affected Versions: CWD Web Designer Easy Elements Hider versions 2.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can...

CVE-2025-28971: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CWD Web Designer Easy Elements Hider easy-elements-hider allows Stored XSS.This issue affects Easy Elements Hider: from n/a through = 2.0...

CVE-2025-5665

A vulnerability was found in FreeFloat FTP Server 1.0. It has been classified as critical. Affected is an unknown function of the component XCWD Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public a...

CVE-2002-2232

Buffer overflow in Enceladus Server Suite 3.9 allows remote attackers to execute arbitrary code via a long CD CWD command...

CVE-1999-0219

Buffer overflow in FTP Serv-U 2.5 allows remote authenticated users to cause a denial of service crash via a long 1 CWD or 2 LS list command...

CVE-1999-0362

WSFTP server remote denial of service through cwd command...

CVE-2025-22655

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Caio Web Dev CWD – Stealth Links cwd-stealth-links allows SQL Injection.This issue affects CWD – Stealth Links: from n/a through = 1.3...

CVE-2025-22655 WordPress CWD - Stealth Links plugin <= 1.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Caio Web Dev CWD – Stealth Links cwd-stealth-links allows SQL Injection.This issue affects CWD – Stealth Links: from n/a through = 1.3...

CVE-2025-22655 WordPress CWD - Stealth Links plugin <= 1.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Caio Web Dev CWD – Stealth Links cwd-stealth-links allows SQL Injection.This issue affects CWD – Stealth Links: from n/a through = 1.3...

WordPress plugin CWD – Stealth Links SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

PT-2025-16970 · Unknown · Cwd – Stealth Links

Name of the Vulnerable Software and Affected Versions: CWD – Stealth Links versions n/a through 1.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This allows for SQL Injection attacks. Recommendations:...

CVE-2024-49632

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Senthil Vel CWD 3D Image Gallery cwd-3d-image-gallery allows Reflection Injection.This issue affects CWD 3D Image Gallery: from n/a through = 1.0...