Malicious code in lovable-cookies-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2866fddcd00a7e51784a043c672960b21264ee2449d71b72d5382f7ab14050b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in internal-test-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3552cfd630fb30cd112a4c9ff8987f36a6de0941482cd2cb33abc0f7c43819c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-55316

External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally...

Azure Connected Machine Agent Elevation of Privilege Vulnerability

External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally...

PT-2025-36895

Name of the Vulnerable Software and Affected Versions: Azure Arc affected versions not specified Description: The software contains a flaw related to external control of file name or path. This allows an authorized attacker to elevate privileges locally. Recommendations: At the moment, there is n...

Sitecore Experience Manager 安全漏洞

Sitecore Experience Manager XM is a management software from Sitecore, Denmark. A security vulnerability exists in Sitecore Experience Manager versions 9.0 through 9.3 and 10.0 through 10.4 and Sitecore Experience Platform versions 9.0 through 9.3 and 10.0 through 10.4, which stems from the use o...

CVE-2025-54945

An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary system commands via a malicious file by controlling the destination file path...

CVE-2025-54945

An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary system commands via a malicious file by controlling the destination file path...

CVE-2025-54945 SUNNET Corporate Training Management System - External Control of File Name or Path

An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary system commands via a malicious file by controlling the destination file path...

CVE-2025-54945

CVE-2025-54945 affects SUNNET Corporate Training Management System prior to 10.11. The vulnerability is an external control of file name or path that enables remote attackers to execute arbitrary system commands by steering the destination file path. No explicit exploitation details are provided ...

CVE-2025-54945 SUNNET Corporate Training Management System - External Control of File Name or Path

An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary system commands via a malicious file by controlling the destination file path...

SUNNET Corporate Training Management System 安全漏洞

SUNNET Corporate Training Management System is a corporate training management system from SUNNET. A security vulnerability exists in SUNNET Corporate Training Management System versions prior to 10.11, which originates from an external control over file names or paths and could lead to the...

Malicious code in donuts.node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9bd852600a317ae1df99af9e6cede53d3f54d36b9a400ca672eff6a7146818a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for External Control of File Name or Path in Microsoft

CVE-2025-33053 POC Exploit Overview The working director...

CVE-2025-41452

Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow for a denial of service attack induced by improper handling of exceptional conditions...

CVE-2025-41452 Post auth nginx configuration injection in Danfoss AK-SM8xxA Series

Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow for a denial of service attack induced by improper handling of exceptional conditions...

Craft CMS < 4.15.3 / 5.x < 5.7.5 External Control of Assumed-Immutable Web Parameter

The version of Craft CMS installed on the remote host is prior to 4.15.3 or 5.x prior to 5.7.5. It is, therefore, affected by an external control of assumed-immutable web parameter vulnerability: - Craft CMS redirects requests that require authentication to the login page and generates a session...

External Control of File Name or Path

Overview @directus/api is a real-time API and App dashboard for managing SQL database content Affected versions of this package are vulnerable to External Control of File Name or Path via the write and join method, which used the fullPath method to create the absolute path. An attacker can upload...

CVE-2025-54551

Synapse Mobility 8.0, 8.0.1, 8.0.2, 8.1, and 8.1.1 contain a privilege escalation vulnerability through external control of Web parameter. If exploited, a user of the product may escalate the privilege and access data that the user do not have permission to view by altering the parameters of the...

FUJIFILM Synapse Mobility 安全漏洞

FUJIFILM Synapse Mobility is a medical image viewing platform from Fujifilm FUJIFILM Japan. A security vulnerability exists in FUJIFILM Synapse Mobility that stems from improper external control of web parameters, which could result in elevated privileges. The following versions are affected:...