CVE-2025-59244

External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network...

CVE-2025-55316

External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally...

CVE-2025-55316

External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally...

External Control of File Name or Path

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to External Control of File Name or Path due to the vault secret lookup not accounting for the Windows file...

Linux Distros Unpatched Vulnerability : CVE-2025-26646

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network...

External Control of File Name or Path

Overview io.pebbletemplates:pebble is a java templating engine inspired by Twig. Affected versions of this package are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates...

CVE-2024-12058

External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to read arbitrary files...

PT-2025-1074

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Expedition affected versions not specified Description The issue is related to an arbitrary file deletion vulnerability in Palo Alto Networks Expedition. This vulnerability allows an unauthenticated attacker to delete...

PT-2024-19805 · Unknown · Controller 6000 +1

Name of the Vulnerable Software and Affected Versions: Controller 6000 and Controller 7000 versions 8.60 and prior Controller 6000 and Controller 7000 versions 8.70 prior to vCR8.70.240520a Controller 6000 and Controller 7000 versions 8.80 prior to vCR8.80.240520a Controller 6000 and Controller...

PT-2024-2128 · Ibm · Ibm Watson Cp4D Data Stores

Name of the Vulnerable Software and Affected Versions: IBM Watson CP4D Data Stores versions 4.6.0 through 4.6.3 Description: The issue is related to incorrect external control of a file name or path, which could allow a user with physical access and specific knowledge of the system to modify file...

PT-2023-7417 · Mitsubishi · Gx Works3 +4

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric FA Engineering Software Products affected versions not specified MELSOFT iQ AppPortal affected versions not specified MELSOFT Navigator affected versions not specified Motion Control Setting affected versions not specified...

The vulnerability in the /model/__lang_msg.php microprogramming software of the D-LINK DIR-300 router allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the /model/langmsg.php microprogrammed software in D-LINK DIR-300 routers is related to incorrect external control of file names or files. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...

The vulnerability of the Cisco Prime Infrastructure monitoring and management system, the Cisco Evolved Programmable Network (EPN) Manager software for managing network services, and the Cisco Identity Services Engine platform for managing connection policies arises from improper external control of file names or paths. This allows attackers to write arbitrary files.

The vulnerability of the Cisco Prime Infrastructure monitoring and management system, the Cisco Evolved Programmable Network EPN Manager software for managing network services, and the Cisco Identity Services Engine connection policy management platform are related to improper external manipulati...

@Mail Open webmail client contains multiple vulnerabilities

Overview The @Mail Open 1.04 webmail client contains multiple vulnerabilities including; unrestricted upload of file with dangerous type CWE-434, relative path traversal CWE-23, external control of file name or path CWE-73, and information exposure CWE-200. Description The @Mail Open 1.04 webmail...