CVE-2025-55316: External Control of File Name or Path

External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally...

CVE-2025-53769: External Control of File Name or Path

External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally...

CVE-2025-29866: External Control of File Name or Path

: External Control of File Name or Path vulnerability in TAGFREE X-Free Uploader XFU allows : Parameter Injection.This issue affects X-Free Uploader: from 1.0.1.0084 before 1.0.1.0085, from 2.0.1.0034 before 2.0.1.0035...

CVE-2025-4674: External Control of File Name or Path

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS e.g. Git, but contains metadata for another VCS e.g. Mercurial...

CVE-2024-1244: External Control of File Name or Path

Improper input validation in the OSSEC HIDS agent for Windows prior to version 3.8.0 allows an attacker in with control over the OSSEC server or in possession of the agent's key to configure the agent to connect to a malicious UNC path. This results in the leakage of the machine account NetNTLMv2...

CVE-2024-1243: External Control of File Name or Path

Improper input validation in the Wazuh agent for Windows prior to version 4.8.0 allows an attacker with control over the Wazuh server or agent key to configure the agent to connect to a malicious UNC path. This results in the leakage of the machine account NetNTLMv2 hash, which can be relayed for...

CVE-2025-47956: External Control of File Name or Path

External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally...

CVE-2025-33053: External Control of File Name or Path

External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network...

CVE-2025-48781: External Control of File Name or Path

An external control of file name or path vulnerability in the download file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to obtain partial files by specifying arbitrary file paths...

CVE-2025-26646: External Control of File Name or Path

External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network...

CVE-2025-26684: External Control of File Name or Path

External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally...

CVE-2025-1056: External Control of File Name or Path

Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the server is using. A non-admin user can modify this file to either create files or change the content of files in an admin-protected location. Axis has released a patched version...

CVE-2025-29708: External Control of File Name or Path

SourceCodester Company Website CMS 1.0 contains a file upload vulnerability via the "Create Services" file /dashboard/Services...

CVE-2025-29709: External Control of File Name or Path

SourceCodester Company Website CMS 1.0 has a File upload vulnerability via the "Create portfolio" file /dashboard/portfolio...

CVE-2025-29819: External Control of File Name or Path

External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally...

PT-2025-12739

Name of the Vulnerable Software and Affected Versions B&R APROL versions prior to 4.4-005P Description The issue allows an authenticated network-based attacker to access data from the file system due to an External Control of File Name or Path vulnerability in the APROL Web Portal. Recommendation...

CVE-2024-10210: External Control of File Name or Path

An External Control of File Name or Path vulnerability in the APROL Web Portal used in B&R APROL 4.4-005P may allow an authenticated network-based attacker to access data from the file system...

CVE-2023-45588

An external control of file name or path vulnerability CWE-73 in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process...

CVE-2025-24054: External Control of File Name or Path

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

CVE-2025-1686

Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates that leverage this tag to include files...