CVE-2025-33053

External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network. Recent assessments: cbeek-r7 at June 12, 2025 6:57am UTC reported: CVE-2025-33053 is a zero-day vulnerability that enables remote code execution RCE through abuse of ho...

Microsoft Windows External Control of File Name or Path Vulnerability

Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files...

External Control of File Name or Path

Overview elmsln/haxcms is a Headless CMS for managing and publishing hybrid static, web component driven sites. Affected versions of this package are vulnerable to External Control of File Name or Path via the location parameter in the saveOutline API endpoint. An attacker can read arbitrary file...

MAL-2025-4915 Malicious code in @velorum/browser-authenticator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e353af93d4a22e451dfc92912518b7562320da8c7d93487012fd782d35ff170 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-48781

An external control of file name or path vulnerability in the download file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to obtain partial files by specifying arbitrary file paths...

CVE-2025-48783 Soar Cloud HRD Human Resource Management System - External Control of File Name or Path

An external control of file name or path vulnerability in the delete file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to delete partial files by specifying arbitrary file paths...

CVE-2025-48781 Soar Cloud HRD Human Resource Management System - External Control of File Name or Path

An external control of file name or path vulnerability in the download file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to obtain partial files by specifying arbitrary file paths...

Soar Cloud System Soar Cloud HRD Human Resource Management System 安全漏洞

Soar Cloud System Soar Cloud HRD Human Resource Management System is a human resource management system from Soar Cloud System, Inc. of Taiwan, China. A security vulnerability exists in Soar Cloud System Soar Cloud HRD Human Resource Management System version 7.3.2025.0408 and prior versions, whi...

Soar Cloud System Soar Cloud HRD Human Resource Management System 安全漏洞

Soar Cloud System Soar Cloud HRD Human Resource Management System is a human resource management system from Soar Cloud System, Inc. of Taiwan, China. A security vulnerability exists in Soar Cloud System Soar Cloud HRD Human Resource Management System version 7.3.2025.0408 and prior versions, whi...

Malicious code in copy-package-contents (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 219b6f163c59d78fd936297643511fdfb25a63f8ed99ce66949104cdf17efcad Any computer that has this package installed or running should be considered...

MAL-2025-4668 Malicious code in claude-pr-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78df9511839ca2f1261eadd3b5a9f886167ffbeb2e11f8d7c52f3470474d160e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in atlas-global-npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2da4219e6bc0eb3a57f45a9fef584e5c6b27af790d62395489febfeb78c5bf3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cx-hub-interaction-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17ef553f1f7cb91bd70d99d55deeb1c83c604b68581cbbfaac1f9bddfbdbe6e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability

Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 ...

Malicious code in staking-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed875e99aa706cdf029805b265862f59262c88e1e713e3acc53b2cb78fa82ac4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rand-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6436f09942f4f079368c746cf4533b29a25e588f206b9fe93a3162cc2af031fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in support-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28fe7c392e31b8cca3c992fa5ed19a3d8cd25412287a81ef8b7bf87d19012112 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wrap-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 03a9ed7b659046381b6934ad92828286dcdec2b36fd7cad2a09b4335f51b490c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in qsc-workspace (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4974f7cd2511ced3dc1db7b00b3241f9648759cd72693033c7fb72b32e82080 Any computer that has this package installed or running should be considered...

CVE-2024-9142

External Control of File Name or Path, : Incorrect Permission Assignment for Critical Resource vulnerability in Olgu Computer Systems e-Belediye allows Manipulating Web Input to File System Calls. This issue affects e-Belediye: before 2.0.642...