491585 matches found
CVE-2026-118561 Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274
External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...
CVE-2026-118561
The Single Content Sync module for Drupal (versions 0.0.0 to 1.4.19 ) is vulnerable to an External Control of File Name or Path (CWE-73) issue. The root cause is the module's failure to sufficiently validate file sources and destinations during content imports. An attacker with the import single ...
CVE-2026-118561 Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274
External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...
CVE-2026-118561
External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...
CVE-2026-118574
Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0...
CVE-2026-118574
The Drupal S3 File System (s3fs) module (versions 0.0.0 to 3.12.0 ) contains a vulnerability where it fails to sufficiently isolate upload contexts between separate object operations within the same request. This root cause allows for the potential uploading of objects with incorrect access contr...
CVE-2026-118574 S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279
Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0...
EUVD-2026-113692
Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0...
CVE-2026-118575
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0...
CVE-2026-118576
The Stage File Proxy module for Drupal is vulnerable to Cross-Site Scripting (XSS) due to insufficient validation of file URLs during fallback retrieval. This issue affects versions 0.0.0 to 3.1.7 and 4.0.0 to 4.0.1 . The module is a development tool and is not intended for use on production site...
CVE-2026-118576 Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting XSS. This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1...
EUVD-2026-113688
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting XSS. This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1...
CVE-2026-118576 Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting XSS. This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1...
CVE-2026-118576
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting XSS. This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1...
Gladinet CentreStack & TrioFox - Local File Inclusion
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and...
Apache Flink - Local File Inclusion
Apache Flink 1.11.0 and released in 1.11.1 and 1.11.2 as well allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process aka local file inclusion. id: CVE-2020-17519 info: name: Apache Flink - Local File Inclusion author: pdtea...
Apache httpd <=2.4.29 - Arbitrary File Upload
Apache httpd 2.4.0 to 2.4.29 is susceptible to arbitrary file upload vulnerabilities via the expression specified in , which could match '$' to a newline character in a malicious filename rather than matching only the end of the filename. This could be exploited in environments where uploads of...
CVE-2025-55891
CVE-2025-55891: Heap Corruption in TIFFCP.EXE docuPrinter Pro via Malformed TIFF File Summary A heap corruption vulnerability exists in TIFFCP.EXE, a command-line utility bundled with Neevia docuPrinter Pro, due to the use of an outdated and vulnerable version of libtiff v3.5.7. By supplying a...
CVE-2021-41773
CVE-2021-41773 apache http server vulnerability only works 2.4.49 requirement settings httpd.conf ... LoadModule cgimodule modules/modcgi.so uncomment this line ... AllowOverride none Require all denied comment out this line or set Require all granted ... References...
