PYSEC-2025-143

wangxutech MoneyPrinterTurbo 1.2.6 allows path traversal via /api/v1/download/ URIs such as /api/v1/download//etc/passwd...

MoneyPrinterTurbo 安全漏洞

MoneyPrinterTurbo is a software by Harry's personal developer that generates short HD videos using AI macromodels. A security vulnerability exists in MoneyPrinterTurbo version 1.2.6, which stems from a path traversal issue in the /api/v1/download/ URI that could lead to accessing sensitive files...

CVE-2025-49089

wangxutech MoneyPrinterTurbo 1.2.6 allows path traversal via /api/v1/download/ URIs such as /api/v1/download//etc/passwd...

CVE-2025-49089

wangxutech MoneyPrinterTurbo version 1.2.6 is vulnerable to a path traversal flaw in the /api/v1/download/ endpoint. An attacker can exploit this by using crafted URIs, such as /api/v1/download//etc/passwd, to access sensitive files on the system. The root cause is an improper limitation of a pat...

PT-2025-37728

Name of the Vulnerable Software and Affected Versions wangxutech MoneyPrinterTurbo version 1.2.6 Description The software contains a path traversal flaw. An attacker can exploit this by using crafted '/api/v1/download/' URIs, such as '/api/v1/download//etc/passwd', to access sensitive files. The...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the base64 path after /download/ endpoint. An attacker can access arbitrary files outside the intended document root by providing a crafted base64-encoded path after the download endpoint, bypassing security...

PT-2025-35906

Name of the Vulnerable Software and Affected Versions: appRain CMF version 4.0.5 Description: An authenticated Path Traversal vulnerability exists in the /apprain/common/download/ endpoint. This allows remote users to bypass SecurityManager restrictions and download arbitrary files if they posses...

Weiphp WeiPHP 路径遍历漏洞

Weiphp WeiPHP is a WeChat development platform that supports the development of public numbers and small programs by China's Shenzhen Yuanmeng Yun Weiphp company. Weiphp WeiPHP 5.0 version of the existence of path traversal vulnerability, the vulnerability stems from the file...

Full system file read and delete via GET /api/v1/images/download/{bulk_download_item_name}

Description For invokeai version v6.0.0a1 and below, there is an endpoint for bulk downloading zip file. With some manipulation of the filename arguments, attacker can read and also delete any files on the server through this endpoint. P/S: Tested on Windows Proof of Concept Request: GET...

CVE-2025-5160

A vulnerability classified as problematic has been found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected is the function Download of the file /packetCaptureStrategy/download. The manipulation of the argument Name leads to path traversal. It is possible to launch the attack remotely. The...

Cross-site Scripting (XSS)

Overview phpList/phplist3 is a popular open source newsletter manager. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized...

CVE-2025-32961

The CVE-2025-32961 issue affects the Cuba JPA Web API (Cuba Platform add-on) prior to version 1.1.1, where an attacker could manipulate the input parameter (string with a file path/name) to cause the server to return a Content-Type of text/html for names ending in .html. This can enable execution...

CVE-2025-32961 CUBA JPA Web API Vulnerable to Cross-Site Scripting (XSS) in the /download Endpoint

The Cuba JPA web API enables loading and saving any entities defined in the application data model by sending simple HTTP requests. Prior to version 1.1.1, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name...

CVE-2025-32961 CUBA JPA Web API Vulnerable to Cross-Site Scripting (XSS) in the /download Endpoint

The Cuba JPA web API enables loading and saving any entities defined in the application data model by sending simple HTTP requests. Prior to version 1.1.1, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name...

CVE-2024-13618

The aoa-downloadable WordPress plugin through 0.1.0 lacks authorization and authentication for requests to its download.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip through the downloadmodel endpoint. An attacker can manipulate file paths to write files to arbitrary locations on the server's filesystem, potentially...

CVE-2024-12882 SSRF in comfyanonymous/comfyui

comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery SSRF vulnerability. This vulnerability can be exploited by combining the REST APIs POST /internal/models/download and GET /view, allowing attackers to abuse the victim server's credentials to access...

Eva4 安全漏洞

Eva4 is GoldPanKit open source set based on SpringBoot 2.x, Shiro, MyBatis Plus and knife4j technologies such as rights management infrastructure project , can be used in conjunction with any eva system front-end to complete the development of the rights system . Eva4 v4.1.0 version of a security...

PT-2024-17899 · Tsinghua Unigroup · Tsinghua Unigroup Electronic Archives Management System

Name of the Vulnerable Software and Affected Versions: Tsinghua Unigroup Electronic Archives Management System version 3.2.21080262532 Description: A vulnerability was found in the Tsinghua Unigroup Electronic Archives Management System. It has been classified as problematic and affects the...

PT-2024-31238

Name of the Vulnerable Software and Affected Versions NUS-M9 ERP Management Software version 3.0.0 Description An arbitrary file download issue in the /Doc/DownloadFile component allows attackers to download arbitrary files and access sensitive information via a crafted interface request...