CVE-2026-20872

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

NTLM Hash Disclosure Spoofing Vulnerability

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

NTLM Hash Disclosure Spoofing Vulnerability

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

PT-2026-2734

Name of the Vulnerable Software and Affected Versions Windows Telephony Service affected versions not specified Description An elevation-of-privilege issue exists in the Windows Telephony Service due to improper external control of file names or paths. Successful exploitation may allow an...

PT-2026-2730

CVE-2026-20925 External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. https://t.co/M2xjSW13S7...

Malicious code in experimental-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 946fb0e9d7a8c7da433d27ef4005111b34c3e75f8827686d43696855315d5867 The package experimental-utils was found to contain malicious code. Source: ghsa-malware...

MAL-2026-205 Malicious code in rxjs-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a82756fe99cd57d9fc69d12a33d81146a6d0c78b3afa5926fa2531e1b3ced4eb The package rxjs-js was found to contain malicious code. Source: ghsa-malware b3538568871fe17ed55bb2e7a707cf1ca517f047348a754b2be9ec8798ab2997 Any...

CVE-2021-22454

A component of the HarmonyOS has a External Control of System or Configuration Setting vulnerability. Local attackers may exploit this vulnerability to cause core dump...

Malicious code in n8n-nodes-vbmkajdsa-uehfitvv-ueqjhhhksdlkkmz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd5b9fc4d665c764917757933148572fd5cfca44be431dd6f84281b068b1ccfc The package n8n-nodes-vbmkajdsa-uehfitvv-ueqjhhhksdlkkmz was found to contain malicious code. Source: ghsa-malware...

Malicious code in cng-web-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 018fca29734b6580902f0808df01db408d09cb6704720e6cac215827f5812f75 The package cng-web-lib was found to contain malicious code. Source: ghsa-malware ea72356f6a1b185aea027fcf291bdb55d1a3f4e6ae715b68e42c5e33834a28d9 An...

CVE-2025-66003

An External Control of File Name or Path vulnerability in smb4k allowsl ocal users to perform a local root exploit via smb4k mounthelper if they can access and control the contents of a Samba shareThis issue affects smb4k: from ? before 4.0.5...

UBUNTU-CVE-2025-66003

An External Control of File Name or Path vulnerability in smb4k allowsl ocal users to perform a local root exploit via smb4k mounthelper if they can access and control the contents of a Samba shareThis issue affects smb4k: from ? before 4.0.5...

CVE-2019-7194

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions...

CVE-2019-12297

An issue was discovered in scopd on Motorola routers CX2 1.01 and M2 1.01. There is a Use of an Externally Controlled Format String, reachable via TCP port 8010 or UDP port 8080...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the loadFile, addImage, html and addFont functions. An attacker can access and include arbitrary files from the local file system into generated PDFs. Workaround This vulnerability can be...

CVE-2025-62842

An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can then exploit the vulnerability to read or modify files or directories. We have already fixed the vulnerability in the following version:...

CVE-2025-62842 HBS 3 Hybrid Backup Sync

An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can then exploit the vulnerability to read or modify files or directories. We have already fixed the vulnerability in the following version:...

QNAP Systems HBS 3 Hybrid Backup Sync 安全漏洞

QNAP Systems HBS 3 Hybrid Backup Sync is a backup and synchronization tool from QNAP Systems Taiwan, China. A security vulnerability exists in QNAP Systems HBS 3 Hybrid Backup Sync that originates from external control of file names or paths, which could result in reading or modifying files or...

Malicious code in @peter_wilson12091/internal-json-test-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18430304f650bf998b2421e45c0b8b01fce58239d3dd6fbe9de753128aac9a4d The package @peterwilson12091/internal-json-test-parser was found to contain malicious code. Source: ghsa-malware...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the fspath parameter in the request body. An attacker can overwrite or create arbitrary files within the server's file system by specifying absolute or relative paths, potentially leading to...