CVE-2026-2976 FastApiAdmin Download Endpoint controller.py download_controller information disclosure

A weakness has been identified in FastApiAdmin up to 2.2.0. Affected by this issue is the function downloadcontroller of the file /backend/app/api/v1/modulecommon/file/controller.py of the component Download Endpoint. This manipulation of the argument filepath causes information disclosure. It is...

CVE-2022-50932

Kyocera Command Center RX ECOSYS M2035dn contains a directory traversal vulnerability that allows unauthenticated attackers to read sensitive system files by manipulating file paths under the /js/ path. Attackers can exploit the issue by sending requests like /js/../../../../.../etc/passwd%00.jpg...

CVE-2021-27471

The parsing mechanism that processes certain file types does not provide input sanitization for file paths. This may allow an attacker to craft malicious files that, when opened by Rockwell Automation Connected Components Workbench v12.00.00 and prior, can traverse the file system. If successfull...

CVE-2025-40605

A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by injecting crafted directory-traversal sequences such as ../ and may access files and directories outside the intended restricted path...

Windows WLAN Privilege Escalation

The vulnerability of Windows WLAN operating systems is related to improper external manipulation of file names or file paths. Exploiting this vulnerability can allow an attacker to gain increased privileges...

Path Traversal

mllogger is vulnerable to path traversal. the vulnerability is due to manipulation of the File argument in the loghandler function of mllogger/server.py, which allows an attacker to perform path traversal to read, create, or overwrite files remotely...

CVE-2025-12347 MaxSite CMS save-file-ajax.php unrestricted upload

A flaw has been found in MaxSite CMS up to 109. This issue affects some unknown processing of the file application/maxsite/admin/plugins/editorfiles/save-file-ajax.php. Executing manipulation of the argument filepath/content can lead to unrestricted upload. The attack can be executed remotely. Th...

CVE-2025-12347

CVE-2025-12347 affects MaxSite CMS up to version 109. The vulnerability resides in the interactive handling of file_path/content in the file application/maxsite/admin/plugins/editor_files/save-file-ajax.php, where manipulation can lead to unrestricted file uploads. Exploitation can be performed r...

EUVD-2006-5163

Malware in sbrugna...

EUVD-2017-1569

Malware in sbrugna...

EUVD-2018-20517

Malware in sbrugna...

EUVD-2015-0866

Malware in sbrugna...

EUVD-2025-10703

Malicious code in bioql PyPI...

EUVD-2025-6980

Malicious code in bioql PyPI...

EUVD-2025-17638

Malicious code in bioql PyPI...

EUVD-2025-12221

Malicious code in bioql PyPI...

EUVD-2021-7493

Malicious code in bioql PyPI...

PT-2025-36480

Name of the Vulnerable Software and Affected Versions: SimStudioAI sim versions up to 1.0.0 Description: A vulnerability exists in SimStudioAI sim that allows for server-side request forgery. The issue is related to the manipulation of the filePath argument within a file located at...

Forminator Plugin Code Execution

The vulnerability of the entrydelete UploadFiles function in the Forminator plugin of the WordPress content management system is related to improper external manipulation of file names or file paths. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

PT-2025-28163

Name of the Vulnerable Software and Affected Versions: run-llama/llama index versions 0.12.27 through 0.12.40 Description: A path traversal vulnerability exists, specifically within the encode image function in generic utils.py, allowing an attacker to manipulate the image path input to read...