Exploit for External Control of File Name or Path in Microsoft

CVE-2025-2405...

MAL-2025-190572 Malicious code in react-svg-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9b392459196e5602d6e40cd38445d10e87e49d85b53b966aee554dd758fc1bd The package react-svg-module was found to contain malicious code. Source: ghsa-malware dd046bd4ddd4da53330303e0802201fda828bce7e1a21524aa7fc0da1fed95...

EUVD-2025-198068

Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges via obtaining the external control key from the config file...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the process of obtaining the external control key from the configuration file. An attacker can access arbitrary files with elevated privileges by leveraging authenticated access with low-level privileges...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the process of obtaining the external control key from the configuration file. An attacker can access arbitrary files with elevated privileges by leveraging authenticated access with low-level privileges...

CVE-2025-56499

Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges via obtaining the external control key from the config file...

CVE-2025-56499

Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges via obtaining the external control key from the config file...

Malicious code in tailwindcss-setfavicon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91fc0eceb962b96f45fa2c5b85fe82bd7dd8a56b13ee4fe7e460091b7650af6f The package tailwindcss-setfavicon was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190556 Malicious code in 1libxmljs2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aabdd956b939ba7ecadbced1795cced1214b25b2faf5920d3dd1f80374b42390 The package 1libxmljs2 was found to contain malicious code. Source: ghsa-malware f356ae30a62d4d1611f89041412c4c86aadd5c438b5809c1d4ee201ee814ea26 Any...

CVE-2025-56499

Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges via obtaining the external control key from the config file...

CVE-2025-56499

Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges via obtaining the external control key from the config file...

CVE-2025-56499

VULNERABILITY: CVE-2025-56499 affects mihomo v1.19.11. Description: an access-control issue allows authenticated attackers with low privileges to read arbitrary files with elevated privileges by obtaining the external control key from the configuration file. Impact: elevated read access (confiden...

PT-2025-47393

Name of the Vulnerable Software and Affected Versions mihomo version 1.19.11 Description An access control issue exists in mihomo version 1.19.11. Authenticated attackers with limited privileges can read arbitrary files with higher privileges. This is achieved by obtaining an external control key...

MAL-2025-190506 Malicious code in integrator-2829 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6bcecff983d9f430d14498333405f44d090846f460508f71de76679fb2076e9 The package integrator-2829 was found to contain malicious code. Source: ghsa-malware e38f5e4a7250f8d8199f26a59e70750071a304fc729893e38b7074a1cd3ab50...

Intel CIP elevation of privilege vulnerability (CNVD-2025-28672)

Intel CIP is an optional program from Intel designed to improve products by collecting performance data from users' computers. Intel CIP suffers from an elevation of privilege vulnerability that stems from improper external control of filenames or paths, and no details of the vulnerability are...

CVE-2025-64726 External Control of System or Configuration Setting and Uncontrolled Search Path Element in sfw

Socket Firewall is an HTTP/HTTPS proxy server that intercepts package manager requests and enforces security policies by blocking dangerous packages. Socket Firewall binary versions separate from installers prior to 0.15.5 are vulnerable to arbitrary code execution when run in untrusted project...

CVE-2025-64726

Socket Firewall (sfw) is affected for binary versions prior to 0.15.5. The vulnerability allows arbitrary code execution when run in an untrusted project directory by placing a malicious .sfw.config; loading the file populates environment variables into the Node.js process, enabling an attacker t...

EUVD-2025-175325

External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access...

CVE-2025-64739

External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access...

CVE-2025-64738 Zoom Workplace for macOS - External Control of File Name or Path

External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclosure of information via local access...