1073 matches found
CVE-2025-15487
CVE-2025-15487 affects the WordPress Code Explorer plugin up to version 1.4.6. The root cause is a path traversal flaw exploitable via the file parameter, allowing authenticated attackers with Administrator-level access to read arbitrary server files. Impact is exposure of sensitive information; ...
CVE-2025-15487 Code Explorer <= 1.4.6 - Authenticated (Administrator+) Arbitrary File Read via 'file' Parameter
The Code Explorer plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.6 via the 'file' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which...
EUVD-2025-206809
The Code Explorer plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.6 via the 'file' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which...
PT-2026-5888
Name of the Vulnerable Software and Affected Versions WordPress Code Explorer plugin versions through 1.4.6 Description The Code Explorer plugin for WordPress has a flaw that allows authorized users with Administrator-level access or higher to read arbitrary files on the server. This is possible...
CVE-2025-15487: Improper Limitation of a Pathname to a Restricted Directory
The Code Explorer plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.6 via the 'file' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which...
WordPress Code Explorer plugin <= 1.4.6 - Authenticated (Administrator+) Arbitrary File Read via 'file' Parameter vulnerability
Authenticated Administrator+ Arbitrary File Read via 'file' Parameter vulnerability discovered by 0x34rth in WordPress Plugin Code Explorer versions = 1.4.6...
bolo-solo 路径遍历漏洞
Bolo-Solo is a blog system developed under the open source Bolo-Blog project. Versions of Bolo-Solo 2.6.4 and earlier contained a path traversal vulnerability. This vulnerability stemmed from the improper handling of parameters File in the importFromCnblogs function in the file...
CVE-2020-37031: Out-of-bounds Write
Simple Startup Manager 1.17 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting memory through the 'File' input parameter. Attackers can craft a malicious payload with 268 bytes to trigger code execution, bypassing DEP and overwriting memo...
VulnCheck KEV: CVE-2022-30777
Parallels H-Sphere 3.6.1713 allows XSS via the indexen.php from parameter...
Code-Projects Online Music Site SQL Injection Vulnerability
Code-Projects Online Music Site is an online music website developed by Code-Projects as open source. Version 1.0 of Code-Projects Online Music Site has a SQL injection vulnerability. This vulnerability stems from incorrect handling of parameters related to files, administrators, and the...
News Portal Project: Vulnerability Exposing Deleted Files
News Portal Project is a news portal project developed by PHPGurukul. The News Portal Project has a vulnerability regarding arbitrary file deletion. This vulnerability stems from improper handling of the 'file' parameter in the removefile.php file. Attackers can exploit this vulnerability to caus...
CVE-2023-54341
Webgrind 1.1 and before contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts via the file parameter in index.php. The application does not sufficiently encode user-controlled inputs, allowing attackers to execute arbitrary...
CVE-2023-54341 Webgrind 1.1 - Reflected Cross-Site Scripting (XSS) via file Parameter
Webgrind 1.1 and before contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts via the file parameter in index.php. The application does not sufficiently encode user-controlled inputs, allowing attackers to execute arbitrary...
CVE-2023-54341 Webgrind 1.1 - Reflected Cross-Site Scripting (XSS) via file Parameter
Webgrind 1.1 and before contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts via the file parameter in index.php. The application does not sufficiently encode user-controlled inputs, allowing attackers to execute arbitrary...
CVE-2023-54341
Webgrind 1.1 and earlier are affected by a reflected XSS via the file parameter in index.php. The vulnerability arises from insufficient encoding of user-controlled input, allowing unauthenticated attackers to inject arbitrary JavaScript by crafting malicious URLs. Affected component: Webgrind (P...
CVE-2025-69990
phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in removefile.php. The parameter file can cause any file to be deleted...
PT-2026-2431
Name of the Vulnerable Software and Affected Versions Webgrind versions 1.1 and earlier Description The application does not adequately encode user-supplied data, enabling unauthenticated attackers to inject malicious scripts through the file parameter in the 'index.php' file. This allows attacke...
CVE-2023-54341: Improper Neutralization of Input During Web Page Generation
Webgrind 1.1 and before contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts via the file parameter in index.php. The application does not sufficiently encode user-controlled inputs, allowing attackers to execute arbitrary...
Webgrind 跨站脚本漏洞
Webgrind is a web-based PHP performance analysis tool from the individual developer Joakim Nygård. A cross-site scripting vulnerability exists in Webgrind 1.1 and earlier versions, which stems from insufficiently encoded user input in the file parameter of index.php, and could lead to a reflectiv...
