14472 matches found
CVE-2025-46704 Advantech iView Path Traversal
A vulnerability exists in Advantech iView in NetworkServlet.processImportRequest that could allow for a directory traversal attack. This issue requires an authenticated attacker with at least user-level privileges. A specific parameter is not properly sanitized or normalized, potentially allowing...
CVE-2025-46704
Advantech iView contains a directory traversal vulnerability in NetworkServlet.processImportRequest() that an authenticated user (at least user-level) can exploit to infer existence of arbitrary files on the server. The root cause is a parameter that is not properly sanitized or normalized. Explo...
CVE-2025-49538
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An attacker can exploit this issue by injecting crafted XML or XPath queries to access unauthorized files or lead to denial of service. Exploitati...
CVE-2025-41668
A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute access to any file on the device...
CVE-2025-41666
A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the device after the watchdog has been initialized...
CVE-2025-41667
A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file on the device...
ZKTeco BioTime < 9.0.1 (20240617.19506) Multiple Vulnerebilities
According to its self-reported version, the instance of ZKTeco BioTime running on the remote web server is prior to 9.0.1 20240617.19506. It is, therefore, affected by multiple vulnerabilities. - A path traversal vulnerability in the iclock API allows unauthenticated attackers to read arbitrary...
gnome-remote-desktop: Uncontrolled Resource Consumption due to Malformed RDP PDUs
A flaw was found in gnome-remote-desktop. Once gnome-remote-desktop listens for RDP connections, an unauthenticated attacker can exhaust system resources and repeatedly crash the process. There may be a resource leak after many attacks, which will also result in gnome-remote-desktop no longer bei...
CVE-2025-44177
A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences...
CVE-2025-53375
Dokploy is a self-hostable Platform as a Service PaaS that simplifies the deployment and management of applications and databases. An authenticated attacker can read any file that the Traefik process user can access e.g., /etc/passwd, application source, environment variable files containing...
CVE-2025-27028
The Linux deprivileged user vpuser in Radiflow iSAP Smart Collector CentOS 7 - VSAP 1.20 can read the entire file system content, including files belonging to other users and having restricted access like, for example, the root password hash...
Path Traversal
llama-index-core is vulnerable to Path Traversal. The vulnerability is due to insufficient sanitization of the imagepath parameter in the encodeimage function, allowing attackers to access arbitrary files on the server...
PT-2025-28956 · Evesys · Evesys
Name of the Vulnerable Software and Affected Versions: evesys versions 7.1 2152 through 8.0 2202 Description: The software contains a reflected cross-site scripting XSS issue. The issue is located in the indexeva.php file through the action parameter. Recommendations: evesys versions prior to 7.1...
CVE-2025-44177
A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences...
CVE-2025-44177
Summary (concrete details from connected docs): White Star Software Protop (version 4.4.2-2024-11-27) is vulnerable to a directory traversal in the /pt3upd/ endpoint. An unauthenticated attacker can read arbitrary files on the OS by using encoded traversal sequences (e.g., URL-encoded payloads). ...
CVE-2025-49538
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An attacker can exploit this issue by injecting crafted XML or XPath queries to access unauthorized files or lead to denial of service. Exploitati...
CVE-2025-49538 ColdFusion | XML Injection (aka Blind XPath Injection) (CWE-91)
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An attacker can exploit this issue by injecting crafted XML or XPath queries to access unauthorized files or lead to denial of service. Exploitati...
CVE-2025-49538 ColdFusion | XML Injection (aka Blind XPath Injection) (CWE-91)
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An attacker can exploit this issue by injecting crafted XML or XPath queries to access unauthorized files or lead to denial of service. Exploitati...
CVE-2025-49538
CVE-2025-49538 affects Adobe ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier. It is an XML Injection vulnerability that can lead to arbitrary file system read (and DoS); exploitation uses crafted XML/XPath and requires access to shared secrets, with no user interaction. Adobe APSB25-69 a...
