PT-2025-15505 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a use after free vulnerability in the implementation of the Lightweight Directory Access Protocol LDAP in the Windows operating system. This vulnerability allows an...

PT-2025-15512 · Microsoft · Windows Rdp Client +1

Name of the Vulnerable Software and Affected Versions: Windows LDAP versions prior to the fixed version Description: The issue is related to a use after free vulnerability in the Windows LDAP protocol, allowing an unauthorized attacker to execute code over a network. This vulnerability enables...

Microsoft Lightweight Directory Access Protocol（LDAP） 资源管理错误漏洞

Microsoft Lightweight Directory Access Protocol LDAP is a directory services protocol from Microsoft Corporation USA that runs on a layer above the TCP/IP stack. A resource management error vulnerability exists in Microsoft Lightweight Directory Access Protocol LDAP. An attacker exploiting this...

CVE-2025-30596

CVE-2025-30596 concerns an authenticated path traversal vulnerability in the WordPress plugin 'include-file' (

PT-2025-14703 · Unknown · Notfound Include-File

Name of the Vulnerable Software and Affected Versions: NotFound include-file versions n/a through 1 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability, in the NotFound include-file. This vulnerability...

CVE-2025-30910

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in CreativeMindsSolutions CM Download Manager cm-download-manager allows Path Traversal.This issue affects CM Download Manager: from n/a through = 2.9.6...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal where an attacker can traverse the file system and access files outside of the intended directory. PoC 1 Install the files-bucket-server package: npm install files-bucket-server 2 Create a new directory: mkdir...

DB-GPT Arbitrary File Write vulnerability

In eosphoros-ai/db-gpt version v0.6.3 and earlier, the web API POST /api/v1/editor/chart/run allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write, enabling them to write arbitrary files to the victim...

CVE-2024-8898

CVE-2024-8898 affects the Parisneo/Lollms-WebUI project, specifically the internal APIs at the install and uninstall endpoints for version V12 (Strawberry). The root cause is insufficient sanitization of user-supplied input, enabling path traversal that can create or delete directories via arbitr...

Open WebUI 安全漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI Open Source. A security vulnerability exists in Open WebUI version v10, which stems from improper path cleanup and could lead to unauthorized directory access...

CVE-2024-30143

HCL AppScan Traffic Recorder fails to adequately neutralize special characters within the filename, potentially allowing it to resolve to a location beyond the restricted directory. Potential exploits can completely disrupt or takeover the application or the computer where the application is...

CVE-2025-26779

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Fahad Mahmood Keep Backup Daily keep-backup-daily allows Path Traversal.This issue affects Keep Backup Daily: from n/a through = 2.1.0...

New Xerox Printer Flaws Could Let Attackers Capture Windows Active Directory Credentials

Security vulnerabilities have been disclosed in Xerox VersaLink C7025 Multifunction printers MFPs that could allow attackers to capture authentication credentials via pass-back attacks via Lightweight Directory Access Protocol LDAP and SMB/FTP services. "This pass-back style attack leverages a...

RHEL 8 : redhat-ds:11 (RHSA-2025:1632)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:1632 advisory. Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol...

The vulnerability of Mendix LDAP module in the deployment and application testing software platform of Mendix allows a hacker to bypass security restrictions.

The vulnerability of Mendix LDAP in the software deployment and application testing platform relates to the failure to eliminate special elements in LDAP requests. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...

PT-2025-6781 · Progress · In Progress Telerik Ui For Winforms

Name of the Vulnerable Software and Affected Versions: In Progress Telerik UI for WinForms versions prior to 2025 Q1 2025.1.211 Description: The issue is related to the improper limitation of a target path, which can lead to decompressing an archive's content into a restricted directory. This can...

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

...

CVE-2024-4941

A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input validation in the postprocess function within gradio/components/jsoncomponent.py, where a user-controlled string is parsed as JSON. If the parsed JSON...

CVE-2024-57451

ChestnutCMS =1.5.0 has a directory traversal vulnerability in contentcore.controller.FileControllergetFileList, which allows attackers to view any directory...

PT-2025-4065 · Wondershare · Wondershare Dr.Fone

Name of the Vulnerable Software and Affected Versions: Wondershare Dr.Fone version 13.5.21 Description: A privilege escalation vulnerability has been found in Wondershare Dr.Fone. This issue could allow an attacker to escalate privileges by replacing the binary...