CVE-2025-26646

External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network...

External Control of File Name or Path

Overview Microsoft.Build.Tasks.Core is a This package contains the Microsoft.Build.Tasks assembly which implements the commonly used tasks of MSBuild. Affected versions of this package are vulnerable to External Control of File Name or Path due to the external control of file name or path. An...

CVE-2025-26684

External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally...

CVE-2025-26684: External Control of File Name or Path

External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally...

CVE-2025-26646: External Control of File Name or Path

External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network...

CVE-2025-47817: External Control of Assumed-Immutable Web Parameter

In BlueWave Checkmate through 2.0.2 before b387eba, a profile edit request can include a role parameter...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path during schema parsing. Although loading untrusted classes is no longer vulnerable via this vector as of version 1.15.1, by default an attacker who can control a trusted class can execute arbitrary...

MAL-2025-3637 Malicious code in mock-arduino (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48d73b70939f251f17499370180f9ead09a5ee724078cbec4a11fe29a9a9f02b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mock-arduino (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48d73b70939f251f17499370180f9ead09a5ee724078cbec4a11fe29a9a9f02b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

External Control of System or Configuration Setting

Overview django-stubs is a Mypy stubs for Django Affected versions of this package are vulnerable to External Control of System or Configuration Setting via the inclusion of type stubs for deprecated and insecure password hashers such as MD5PasswordHasher, SHA1PasswordHasher, and...

Malicious code in crypto-encrypt-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ef44f851c3516fca1e3dc72236ae2c87cf821ded922150cca14e07ff9b4fbcb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-1056: External Control of File Name or Path

Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the server is using. A non-admin user can modify this file to either create files or change the content of files in an admin-protected location. Axis has released a patched version...

Malicious code in @0xzyo/confutionrce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f2d1c1c9b369aed6d0d62b32d27becf33fda24166695accd6ecf90d1ece233e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-29709: External Control of File Name or Path

SourceCodester Company Website CMS 1.0 has a File upload vulnerability via the "Create portfolio" file /dashboard/portfolio...

CVE-2025-29708: External Control of File Name or Path

SourceCodester Company Website CMS 1.0 contains a file upload vulnerability via the "Create Services" file /dashboard/Services...

CVE-2025-30512 Growatt Cloud portal External Control of System or Configuration Setting

Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely e.g., on/off...

CVE-2025-30512: External Control of System or Configuration Setting

Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely e.g., on/off...

Malicious code in wormhole-messenger-solana (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3533c227d2e503f88e2ae202b9433a6a7a89000b952c2875242b1834dbd32089 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-29819

External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally...

CVE-2025-29819: External Control of File Name or Path

External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally...