Oracle Agile Product Lifecycle Management (PLM) 9.3.6.x < 9.3.6.28.3 (CVE-2024-21287)

The version of Oracle Agile Product Lifecycle Management PLM on the remote host is 9.3.6.x prior to 9.3.6.28.3. It is, therefore, affected by an unauthenticated remote file disclosure vulnerability: - Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain component: Softwa...

LuxSoft LuxCal Web Calendar 访问控制错误漏洞

LuxSoft LuxCal Web Calendar is a free user-friendly lightweight web-based event calendar from LuxSoft Switzerland. An access control error vulnerability exists in LuxSoft LuxCal Web Calendar versions prior to 5.3.3M and prior to 5.3.3L, which stems from a missing authentication in dloader.php and...

LuxSoft LuxCal Web Calendar 路径遍历漏洞

LuxSoft LuxCal Web Calendar is a free user-friendly lightweight web-based event calendar from LuxSoft Switzerland. A path traversal vulnerability exists in LuxSoft LuxCal Web Calendar versions prior to 5.3.3M and prior to 5.3.3L, which stems from a path traversal issue in dloader.php that could...

PT-2025-6808 · WordPress · Bit Assist

Name of the Vulnerable Software and Affected Versions: Bit Assist plugin for WordPress versions up to, and including, 1.5.2 Description: The issue allows authenticated attackers with Subscriber-level access and above to read the contents of arbitrary files on the server, which can contain sensiti...

SUSE CVE-2023-3823

In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling...

WS-2022-0243

The package tower-http is vulnerable to file disclosure due to improper validation of Windows paths, which may lead to path traversal. An attacker can access arbitrary files in the server. versions 0.1.3 and 0.2.1 contain a patch for this issue...

CVE-2024-13374

Summary (CVE-2024-13374) The WordPress plugin WP Table Manager is affected up to version 4.1.3 . The vulnerability stems from a missing capability check in the AJAX action thewptm_getFolders , allowing authenticated attackers with Subscriber-level access or higher to read arbitrary file names and...

CVE-2024-13374 WP Table Manager <= 4.1.3 - Missing Authorization to Authenticated (Subscriber+) Directory Traversal to Folder/File Name Disclosure

The WP Table Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on thewptmgetFolders AJAX action in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read...

The vulnerability of the JDBC_PING configuration of the Infinispan data storage software allows a hacker to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the JDBCPING configuration in the Infinispan data storage software is related to the disclosure of information through registration files in the log files. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain unauthorized access to...

CVE-2022-36081

Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, Wikmd is vulnerable to path traversal when accessing /list/ and discloses lists of files located on the server including sensitive data. Version 1.7.1 fixes this issue...

CVE-2022-31176

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome. An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized fil...

CVE-2022-39296

MelisAssetManager provides deliveries of Melis Platform's assets located in every module's public folder. Attackers can read arbitrary files on affected versions of melisplatform/melis-asset-manager, leading to the disclosure of sensitive information. Conducting this attack does not require...

CVE-2020-13298

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Conan package upload functionality was not properly validating the supplied parameters, which resulted in the limited files disclosure...

CVE-2020-26831

SAP BusinessObjects BI Platform Crystal Report, versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing XML validation, An attacker with basic privileges can inject some arbitrary XML entities leading to internal file...

CVE-2025-24963

Vitest is a testing framework powered by Vite. The "screenshot-error" handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by "browser.api.host: true", an attacker can send a request to that handler from remote to ge...

PT-2025-2242 · WordPress · Music Sheet Viewer

Name of the Vulnerable Software and Affected Versions: Music Sheet Viewer plugin for WordPress versions up to and including 4.1 Description: The issue allows unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information, through the read...

CVE-2025-23212 Tandoor Recipes - Local file disclosure - Users can read the content of any file on the server

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The external storage feature allows any user to enumerate the name and content of files on the server. This vulnerability is fixed in 1.5.28...

CVE-2025-23212 Tandoor Recipes - Local file disclosure - Users can read the content of any file on the server

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The external storage feature allows any user to enumerate the name and content of files on the server. This vulnerability is fixed in 1.5.28...

CVE-2024-45598

Cacti is an open source performance and fault management framework. Prior to 1.2.29, an administrator can change the "Poller Standard Error Log Path" parameter in either Installation Step 5 or in Configuration-Settings-Paths tab to a local file inside the server. Then simply going to Logs tab and...

CVE-2024-45598: Improper Limitation of a Pathname to a Restricted Directory

Cacti is an open source performance and fault management framework. Prior to 1.2.29, an administrator can change the Poller Standard Error Log Path parameter in either Installation Step 5 or in Configuration-Settings-Paths tab to a local file inside the server. Then simply going to Logs tab and...