WordPress plugin Muji has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

NTLM Spoofing

The vulnerability of the NTLM protocol implemented by the Windows operating system is related to incorrect external management of file names or paths. Exploiting this vulnerability allows a malicious actor to perform spoofing attacks remotely...

Windows Telephony Service Privilege Escalation

The vulnerability of the Windows Operating System’s Telephony Service is related to improper external management of file names or file paths. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...

PT-2026-41380

Уязвимость модуля landing сервиса для управления бизнесом Битрикс24 исистемы управления содержимым сайтов CMS 1С-Битрикс: Управление сайтом связана с неверным управлением именами файлов для PHP-функций include или require. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо,...

WordPress plugin Hope has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

FULL Customer Content Management System WordPress Plugin File Inclusion

The vulnerability of the FULL Customer Content Management System for WordPress involves improper handling of file names for PHP functions like include or require. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or execute arbitrary code...

NagVis Information Disclosure

The vulnerability of the NagVis data visualization tool, a component of the Nagios XI IT infrastructure monitoring tool, is related to improper management of file names used by PHP functions like include or require. Exploiting this vulnerability can allow an attacker to disclose confidential...

Motors Events Plugin Unauthorized Access

The vulnerability of the Motors plugin involves the WordPress content management system’s event handling mechanism, which is related to improper handling of file names for PHP functions like include or require. Exploiting this vulnerability can allow an attacker to gain unauthorized access to...

eXtplorer security vulnerabilities

eXtplorer is a PHP-based file manager by soerennb individual developer. A security vulnerability exists in eXtplorer 2.1.15 and earlier versions, which stems from cross-site scripting in the file name handling component...

NTLM Hash Spoofing

The vulnerability of the NTLM Hash component in Windows operating systems is related to incorrect external management of file names or file paths. Exploiting this vulnerability allows a remote attacker to perform spoofing attacks...

Azure Compute Gallery File Path Privilege Escalation

The vulnerability of the software for creating and managing images of virtual machines and Azure Compute Gallery containers is related to improper external management of file names or paths. Exploiting this vulnerability can allow an attacker to increase their privileges...

Azure Compute Gallery File Path Privilege Escalation

The vulnerability of the software for creating and managing images of virtual machines and containers in Azure Compute Gallery is related to improper external management of file names or paths. Exploiting this vulnerability can allow an attacker to increase their privileges...

TOTOLINK CA300-PoE Router setUpgradeUboot() Arbitrary Command Execution

The vulnerability of the setUpgradeUboot function in the upgrade.so library of TOTOLINK CA300-PoE router microprogramming software is related to the failure to take measures to clean data at the management level when processing the FileName parameter. Exploiting this vulnerability can allow an...

WordPress plugin ZoloBlocks has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Houzez has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

TOTOLINK CA300-PoE Command Injection Vulnerability

The TOTOLINK CA300-PoE is a wireless access point device manufactured by China's Gion Electronics TOTOLINK. TOTOLINK CA300-PoE suffers from a command injection vulnerability that stems from the improper handling of the parameter FileName in the file upgrade.so, no details of the vulnerability are...

AZL-63854 CVE-2025-5917 affecting package libarchive for versions less than 3.6.1-7

A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to...

USN-7509-1 dotnet8, dotnet9 vulnerability

It was discovered that .NET did not properly handle file names and paths under certain conditions. An attacker could possibly use this issue to perform spoofing over a network...

Microsoft Defender for Endpoint Privilege Escalation

The vulnerability of Microsoft Defender for Endpoint on Linux operating systems is related to incorrect external management of file names or file paths. Exploiting this vulnerability can allow attackers to increase their privileges...

Wangshen SecGate path traversal vulnerability

Wangshen SecGate is a series of gigabit firewalls from China's Wangshen. A path traversal vulnerability exists in the Wangshen SecGate 3600, which stems from path traversal due to incorrect operation of the parameter filename in the file ?g=objareaexportsave...