CVE-2026-51592

CVE-2026-51592 — Path Traversal in TahaBakhtari/SubtitleGenerator Summary A path traversal vulnerability exists in the /updatesubtitle endpoint of TahaBakhtari/SubtitleGenerator. The endpoint accepts a filename parameter from an unauthenticated client and joins it with a fixed base directory usin...

CVE-2026-17602

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to a Directory Traversal (Path Traversal) vulnerability in all versions up to and including 4.7.42 . The root cause is a flaw in handling the 'file_name' parameter. This allows authenticated attackers wit...

CVE-2026-79407

A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILENAME value used by setfilename and loadmetadata in metagpt/ext/spo/utils/load.py. The vulnerable code joins the attacker-controlled FILENAME value with the settings director...

WordPress RapiSafe plugin <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters vulnerability

Unauthenticated Arbitrary File Deletion via 'rsmfcf7session' and 'filename' Parameters vulnerability discovered by Spy0x7 in WordPress Plugin RapiSafe – Secure Multi File Upload for Contact Form 7 versions = 1.0.4...

XAgent 路径遍历漏洞

XAgent is an open-source, experimental large language model-driven autonomous agent developed by OpenBMB. Version XAgent 1.0.0 contains a path traversal vulnerability, which stems from incorrect handling of the filename parameter in the workspace.py function of the XAgentServer/application/router...

EUVD-2017-3088

Malware in sbrugna...

EUVD-2009-2371

Malware in sbrugna...

EUVD-2023-51134

Malicious code in bioql PyPI...

EUVD-2021-28609

Malicious code in bioql PyPI...

CVE-2025-52053

TOTOLINK X6000R V9.4.0cu.1360B20241207 was found to contain a command injection vulnerability in the sub417D74 function via the filename parameter. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request...

CVE-2024-45894

BlueCMS 1.6 suffers from Arbitrary File Deletion via the filename parameter in an /admin/database.php?act=del request...

Wangshen SecGate 路径遍历漏洞

Wangshen SecGate is a series of gigabit firewalls from China's Wangshen. A path traversal vulnerability exists in Wangshen SecGate 3600, which stems from improper handling of the parameter filename in the file ?g=logexportfile, which could lead to a path traversal attack...

CVE-2024-45894

BlueCMS 1.6 suffers from Arbitrary File Deletion via the filename parameter in an /admin/database.php?act=del request...

BlueCMS 安全漏洞

BlueCMS is a content management system CMS based on PHP and MySQL. A security vulnerability exists in BlueCMS version 1.6, which originates from arbitrary file deletion via the filename parameter in the /admin/database.php?act=del request...

CVE-2024-45894

BlueCMS 1.6 suffers from Arbitrary File Deletion via the filename parameter in an /admin/database.php?act=del request...

CVE-2024-0416

The CVE-2024-0416 entry concerns DeShang DSMall (up to v5.0.3). The vulnerability lies in file application/home/controller/MemberAuth.php, where manipulating the file_name argument triggers a path traversal (../filedir). This is a remote issue and the exploit has public disclosure. Impact is tied...

Command injection

TOTOLINK A3300R 17.0.0cu.557B20221024 contains a command injection via the filename parameter in the UploadFirmwareFile function...

CVE-2023-46976

TOTOLINK A3300R 17.0.0cu.557B20221024 contains a command injection via the filename parameter in the UploadFirmwareFile function...

CVE-2023-46976

TOTOLINK A3300R 17.0.0cu.557B20221024 contains a command injection via the filename parameter in the UploadFirmwareFile function...

CVE-2023-46976

CVE-2023-46976 affects TOTOLINK A3300R (version 17.0.0cu.557_B20221024). The vulnerability is a command injection in the UploadFirmwareFile function triggered via the file_name parameter, allowing arbitrary command execution with network access and no user interaction. The NVD entry lists a base ...