CVE-2025-54959

Powered BLUE Server versions 0.20130927 and prior contain a path traversal vulnerability. If this vulnerability is exploited, an arbitrary file in the affected product may be disclosed...

CVE-2025-54959

Powered BLUE Server versions 0.20130927 and prior contain a path traversal vulnerability. If this vulnerability is exploited, an arbitrary file in the affected product may be disclosed...

CVE-2025-54959

Powered BLUE Server versions 0.20130927 and prior contain a path traversal vulnerability. If this vulnerability is exploited, an arbitrary file in the affected product may be disclosed...

CVE-2025-54959

CVE-2025-54959 affects Powered BLUE Server versions 0.20130927 and earlier. The vulnerability is a path traversal that can disclose arbitrary files in the affected product. Impact is described as possible file disclosure by an authenticated user; no exploits are detailed in the provided docs. Mit...

PT-2025-32346 · Unknown · Powered Blue Server

Name of the Vulnerable Software and Affected Versions: Powered BLUE Server versions 0.20130927 and prior Description: Powered BLUE Server versions 0.20130927 and prior contain a path traversal vulnerability that could lead to the disclosure of arbitrary files within the affected product...

Mubit Powered BLUE 870 路径遍历漏洞

Mubit Powered BLUE 870 is a DNS server from Mubit Japan. A path traversal vulnerability exists in Mubit Powered BLUE 870 version 0.20130927 and earlier, which stems from path traversal and could lead to arbitrary file disclosure...

glpi-inventory-plugin 安全漏洞

glpi-inventory-plugin is a GLPI open source GLPI inventory plugin. A security vulnerability exists in glpi-inventory-plugin versions prior to 2.0.2, which stems from a file disclosure vulnerability in the /ajax/screenshot.php endpoint...

The vulnerability of the XtremIO Management Server (XMS) on the Dell XtremIO storage platform allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the XtremIO Management Server XMS on the Dell XtremIO storage platform involves the disclosure of information through log files. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CVE-2014-125125

CVE-2014-125125 describes a path traversal flaw in A10 Networks AX Loadbalancer (versions 2.6.1-GR1-P5, 2.7.0, and earlier) where the filename parameter in the /xml/downloads endpoint is not properly sanitized. An unauthenticated attacker can craft HTTP requests with directory traversal sequences...

Ilevia EVE X1 Server 4.7.18.0.eden (db_log) Pre-Auth File Disclosure

Summary EVE is a smart home and building automation solution designed for both residential and commercial environments, including malls, hotels, restaurants, bars, gyms, spas, boardrooms, and offices. It enables comprehensive control and monitoring of electrical installations through a highly...

📄 Ilevia EVE X1 Server 4.7.18.0.eden File Disclosure

Ilevia EVE X1 Server versions 4.7.18.0.eden and below suffer from an unauthenticated file disclosure vulnerability. Using the dblog POST parameter, attackers can disclose arbitrary files on the affected device and disclose sensitive and system information. Ilevia EVE X1 Server 4.7.18.0.eden dblog...

Metasploit Wrap-Up 07/25/2025

We want to hear from you! Over the next few weeks, we’ll continue to put out user surveys on X as well as Mastodon so you can respond to some of the questions that will help us understand what you want and need from Metasploit Framework! We will also have a survey on our website during DEF CON an...

NewStart CGSL MAIN 7.02 : librsvg2 Vulnerability (NS-SA-2025-0127)

The remote NewStart CGSL host, running version MAIN 7.02, has librsvg2 packages installed that are affected by a vulnerability: - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files on the local filesystem outside ...

WordPress plugin AI Engine 信息泄露漏洞

WordPress AI Engine is a plugin based on OpenAI technology, which is mainly used to integrate artificial intelligence features into WordPress websites to improve the efficiency of content generation, automated operations and so on. WordPress AI Engine suffers from an information disclosure...

Xorcom CompletePBX Authenticated File Disclosure via Backup Download

This module exploits an authenticated file disclosure vulnerability in CompletePBX use auxiliary/scanner/http/xorcomcompletepbxfiledisclosure msf auxiliaryxorcomcompletepbxfiledisclosure show actions ...actions... msf auxiliaryxorcomcompletepbxfiledisclosure set ACTION msf...

Directory Traversal

Overview aim is a super-easy way to record, search and compare AI experiments. Affected versions of this package are vulnerable to Directory Traversal via the restorerunbackup function. An attacker can overwrite critical system files or application configurations by writing arbitrary files to the...

ViewVC 路径遍历漏洞

ViewVC is ViewVC open source a Web-based CVS, SVN code repository browsing tool. A path traversal vulnerability exists in ViewVC versions 1.1.0 to 1.1.31 and 1.2.0 to 1.2.3, which stems from a directory traversal in the standalone.py script, which could lead to the disclosure of the contents of t...

VulnCheck KEV: CVE-2022-38840

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure...

CVE-2025-34118

A path traversal vulnerability exists in Linknat VOS Manager versions prior to 2.1.9.07, including VOS2009 and early VOS3000 builds, that allows unauthenticated remote attackers to read arbitrary files on the server. The vulnerability is accessible via multiple localized subpaths such as '/eng/',...

CVE-2025-34119

A remote file disclosure vulnerability exists in EasyCafe Server 2.2.14, exploitable by unauthenticated remote attackers via TCP port 831. The server listens for a custom protocol where opcode 0x43 can be used to request arbitrary files by absolute path. If the file exists and is accessible, its...