CVE-2025-57802 Airlink's Daemon Symlink Vulnerability

Airlink's Daemon interfaces with Docker and the Panel to provide secure access for controlling instances via the Panel. In version 1.0.0, an attacker with access to the affected container can create symbolic links inside the mounted directory /app/data. Because the container bind-mounts an...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the DownloadTmp function in CommonController.go when handling the fileName argument. An attacker can access arbitrary files on the server by supplying crafted input remotely. Details A Directory Traversal attack...

CVE-2025-29514

Incorrect access control in the config.xgi function of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to download the configuration file via providing a crafted web request...

CVE-2025-8562 Custom Query Shortcode <= 0.4.0 - Authenticated (Contributor+) Path Traversal via lens Parameter

The Custom Query Shortcode plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.4.0 via the 'lens' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of files on the server, which can...

WordPress Pro Bulk Watermark Plugin for WordPress Theme <= 2.0 is vulnerable to Path Traversal

Software Pro Bulk Watermark Plugin for WordPress Type Theme Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Path Traversal CVE CVE-2025-4956 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID cbe2badf404d Credits ch4r0n...

GHSA-PP7P-Q8FX-2968 vite-plugin-static-copy files not included in `src` are possible to access with a crafted request

Summary Files not included in src was possible to access with a crafted request. Impact Only apps explicitly exposing the Vite dev server to the network using --host or server.host config option are affected. Arbitrary files can be disclosed by exploiting this vulnerability. Details Consider the...

PT-2025-35092

Name of the Vulnerable Software and Affected Versions D-Link DIR-868L B1 firmware version FW2.05WWB02 Description The fileaccess.cgi component contains an unauthenticated OS command injection flaw. The endpoint '/dws/api/UploadFile' accepts a pre api arg parameter that is passed directly to...

Barracuda Spam & Virus Firewall 安全漏洞

Barracuda Spam & Virus Firewall is an email security gateway from Barracuda USA. A security vulnerability exists in Barracuda Spam & Virus Firewall, SSL VPN, and Web Application Firewall versions prior to 2010.10, which stems from a path traversal in the viewhelp.cgi endpoint that could lead to...

Linux Distros Unpatched Vulnerability : CVE-2018-6179

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced ...

Linux Distros Unpatched Vulnerability : CVE-2025-2713

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Google gVisor's runsc component exhibited a local privilege escalation vulnerability due to incorrect handling of file access permissions, which allowed...

Linux Distros Unpatched Vulnerability : CVE-2018-6109

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - readAsText can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to...

CVE-2025-55201

Copier library and CLI app for rendering project templates. Prior to 9.9.1, a safe template can currently read and write arbitrary files because Copier exposes a few pathlib.Path objects in the Jinja context which have unconstrained I/O methods. This effectively renders the security model w.r.t...

CVE-2025-20269

The CVE-2025-20269 issue affects Cisco EPNM and Cisco Prime Infrastructure web-based management interfaces. Root cause: insufficient input validation for specific HTTP requests, enabling an authenticated, low-privileged, remote attacker to retrieve arbitrary files from the device’s file system. I...

CVE-2009-10005 ContentKeeper Web Appliance < 125.10 Arbitrary File Access via mimencode

ContentKeeper Web Appliance now maintained by Impero Software versions prior to 125.10 expose the mimencode binary via a CGI endpoint, allowing unauthenticated attackers to retrieve arbitrary files from the filesystem. By crafting a POST request to /cgi-bin/ck/mimencode with traversal and output...

GHSA-8F93-J3FX-72F3 CRI-O has Potential High Memory Consumption from File Read

There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a hi...

CVE-2025-36114

CVE-2025-36114 affects IBM QRadar SOAR Plugin App versions 1.0.0–5.6.0. The issue is a path traversal vulnerability: a remote attacker could send crafted URL requests containing “dot dot” sequences (/../) to view arbitrary files on the system. IBM’s security bulletin notes a fix in version 5.6.2;...

CVE-2025-54927

CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause unauthorized access to sensitive files when an authenticated attackers uses a crafted path input that is processed by the system...

CVE-2025-53561 WordPress Prevent files / folders access Plugin <= 2.6.0 - Path Traversal Vulnerability

Path Traversal: '.../...//' vulnerability in miniOrange Prevent files / folders access prevent-file-access allows Path Traversal.This issue affects Prevent files / folders access: from n/a through = 2.6.0...

CVE-2025-57790

A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. The vulnerability may lead to remote code execution...

CVE-2025-57790

A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. The vulnerability may lead to remote code execution...