94589 matches found
CVE-2026-7133
A vulnerability was determined in code-projects Online Lot Reservation System 1.0. This impacts an unknown function of the file /activity.php. This manipulation of the argument directory causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and...
CVE-2026-41463
Summary: CVE-2026-41463 affects ProjeQtor versions 7.0–12.4.3 and describes a ZipSlip path traversal in the plugin upload functionality. An authenticated attacker with upload permissions can craft ZIP archives with directory traversal sequences to bypass extraction boundaries and write files outs...
EUVD-2026-25861
A vulnerability was determined in code-projects Online Lot Reservation System 1.0. This impacts an unknown function of the file /activity.php. This manipulation of the argument directory causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and...
`unpack_in` can chmod arbitrary directories by following symlinks
In versions 0.6.0 and earlier of astral-tokio-tar, the unpackin API could inadvertently modify the permissions of external i.e. non-archive directories outside of the archive. An attacker could use this to contrite a tar archive that maliciously changes directory permissions outside of its intend...
GHSA-V3VG-332R-MW99 Camel-PQC Vulnerable to Deserialization of Untrusted Data
The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of .key files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to java.security.KeyPair is evaluated only after readObject has...
CVE-2026-40048
CVE-2026-40048 – Apache Camel PQC deserialization flaw : The Camel-PQC FileBasedKeyLifecycleManager deserializes the contents of .key files in the configured key directory via java.io.ObjectInputStream without ObjectInputFilter or class-loading restrictions. The vulnerable step is that the cast t...
CVE-2026-40048 Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager
The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of .key files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to java.security.KeyPair is evaluated only after readObject has...
CVE-2026-7071
Summary: CVE-2026-7071 affects CodeAstro Online Job Portal 1.0. The vulnerability targets an unknown functionality under the path /users/user-cvs/ and leads to file and directory information exposure. The issue is exploitable remotely, and public disclosure of the exploit is noted. There are no e...
CVE-2026-7071
A security vulnerability has been detected in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/user-cvs/. The manipulation leads to file and directory information exposure. Remote exploitation of the attack is possible. The exploit has...
CodeAstro Online Job Portal 信息泄露漏洞
CodeAstro Online Job Portal is an online work portal operated by CodeAstro Corporation. Version 1.0 of CodeAstro Online Job Portal has a vulnerability related to information leakage, which stems from operations on the file/users/user-cvs/ directory. This vulnerability may lead to the exposure of...
CVE-2025-69428
Pro-Bit vulnerability CVE-2025-69428: Affected software is Pro-Bit before v1.77.4. Unauthenticated attackers can directly access a sensitive directory and its subdirectories. Root cause details are not explicitly described beyond the access to the directory tree. The CVE has a CVSS v3.1 base scor...
MkDocs MCP Plugin 路径遍历漏洞
MkDocs MCP Plugin is an open-source document intelligent search and integration tool developed by Dou. Versions of MkDocs MCP Plugin prior to 0.4.1 contained a path traversal vulnerability. This vulnerability stemmed from improper handling of parameters docsdir and filepath in the...
CVE-2025-69428
An issue in Pro-Bit before v1.77.4 allows unauthenticated attackers to directly access sensitive directory and its subdirectories...
IBM Security Verify Directory File Upload Vulnerability
IBM Security Verify Directory is part of an authentication and access management solution from International Business Machines IBM. A file upload vulnerability exists in IBM Security Verify Directory versions 10.0.0 through 10.0.0.3. The vulnerability stems from an unverified file type and can be...
PT-2026-35455
A path traversal vulnerability in the Blocks module of Daylight Studio FuelCMS v1.5.2 allows attackers to execute a directory traversal...
ONNX model cache defaults to world-writable predictable /tmp directory
In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Only applications that use TransformersEmbeddingModel and have the cache enabled, using the default location, are affected...
PT-2026-35369
Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.19.0 through 4.19.x Apache Camel versions 4.18.0 through 4.18.1 Description The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of .key files in the configured key directory using...
LogonTracer 操作系统命令注入漏洞
LogonTracer is a visual system log analysis tool developed by the Japanese JPCERT organization. This product can detect malicious login attempts by analyzing Windows Active Directory event logs. Versions of LogonTracer prior to 2.0.0 contained a vulnerability related to operating system command...
FUEL CMS 路径遍历漏洞
FUEL CMS is a content management system CMS developed by David McReynolds using the Codelgniter framework. Version 1.5.2 of FUEL CMS contains a path traversal vulnerability, which stems from path traversal in the Blocks module and could lead to directory traversal attacks...