CVE-2025-26167

Buffalo LS520D 4.53 is vulnerable to Arbitrary file read, which allows unauthenticated attackers to access the NAS web UI and read arbitrary internal files...

CVE-2025-26167

CVE-2025-26167 covers Buffalo LS520D firmware 4.53, where an unauthenticated user can perform an arbitrary file read via the NAS web UI. The vulnerability context indicates a read access issue affecting internal files, enabling potential exposure of sensitive data. Reported impact is high for con...

netty: Denial of Service attack on windows app using Netty

A flaw was found in Netty. An unsafe reading of the environment file could potentially cause a denial of service. When loaded on a Windows application, Netty attempts to load a file that does not exist. If an attacker creates a large file, the Netty application crashes...

CVE-2024-13471 DesignThemes Core Features <= 4.7 - Missing Authorization to Unauthenticated Arbitrary File Read via dt_process_imported_file

The DesignThemes Core Features plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dtprocessimportedfile function in all versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to read arbitrary files on the...

CVE-2024-13471 DesignThemes Core Features <= 4.7 - Missing Authorization to Unauthenticated Arbitrary File Read via dt_process_imported_file

The DesignThemes Core Features plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dtprocessimportedfile function in all versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to read arbitrary files on the...

Linux Distros Unpatched Vulnerability : CVE-2022-46945

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the component /core/classes/NagVisHoverUrl.php. CVE-2022-46945 Note that...

Linux Distros Unpatched Vulnerability : CVE-2024-29073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes...

WordPress DesignThemes Core Features plugin <= 4.7 - Missing Authorization to Unauthenticated Arbitrary File Read via dt_process_imported_file vulnerability

Missing Authorization to Unauthenticated Arbitrary File Read via dtprocessimportedfile vulnerability discovered by Tonn in WordPress Plugin DesignThemes Core Features versions = 4.7...

CVE-2025-1425 File Read Through Improper Sudo Privilege Management

A Sudo privilege misconfiguration vulnerability in PocketBook InkPad Color 3 on Linux, ARM allows attackers to read file contents on the device.This issue affects InkPad Color 3: U743k3.6.8.3671...

CVE-2025-1425

The CVE-2025-1425 case concerns a sudo privilege misconfiguration in PocketBook InkPad Color 3 (Linux, ARM; affected build U743k3.6.8.3671). The issue enables an attacker to read file contents on the device due to improper sudo permissions. Documented impacts are confined to confidentiality expos...

CVE-2025-1425 File Read Through Improper Sudo Privilege Management

A Sudo privilege misconfiguration vulnerability in PocketBook InkPad Color 3 on Linux, ARM allows attackers to read file contents on the device.This issue affects InkPad Color 3: U743k3.6.8.3671...

Exploit for Server-Side Request Forgery in Bookstackapp Bookstack

phpfilterchainoraclepoc Overview The Synacktiv team pu...

Arbitrary File Read

github.com/mattermost/mattermost-server is vulnerable to Arbitrary File Read. The vulnerability is due to improper validation of board blocks when importing boards, which allows an attacker to perform a path traversal attack by importing and exporting a specially crafted import archive in Boards...

Atlassian JIRA Arbitrary File Read

Atlassian JIRA versions prior to 5.0.1 XML injection proof of concept exploit that lets you read an arbitrary file. ============================================================================================================================================= | Title : Atlassian JIRA before 5.0.1 P...

The vulnerability of the QAnything AI-based question-answering system lies in the incorrect limitation of the path name to the restricted access catalog. This allows attackers to read arbitrary files or execute arbitrary code.

The vulnerability of the QAnything AI-based question-answering system is related to an incorrect restriction on the name of the path to the restricted-access catalog. Exploiting this vulnerability could allow a malicious actor to read arbitrary files or execute arbitrary code remotely...

Linux Distros Unpatched Vulnerability : CVE-2014-3529

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration ...

Ghost CMS 5.59.1 Arbitrary File Read

Ghost CMS version 5.59.1 proof of concept arbitrary file reading exploit. ============================================================================================================================================= | Title : Ghost CMS v 5.59.1 PHP Code Injection Vulnerability | | Author :...

Linux Distros Unpatched Vulnerability : CVE-2014-3242

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SOAPpy 0.12.5 allows remote attackers to read arbitrary files via a SOAP request containing an external entity declaration in conjunction with an entity...

CVE-2025-25185 GPT Academic allows arbitary file read by tarfile uncompress within softlink

GPT Academic provides interactive interfaces for large language models. In 3.91 and earlier, GPT Academic does not properly account for soft links. An attacker can create a malicious file as a soft link pointing to a target file, then package this soft link file into a tar.gz file and upload it...

CVE-2025-25185 GPT Academic allows arbitary file read by tarfile uncompress within softlink

GPT Academic provides interactive interfaces for large language models. In 3.91 and earlier, GPT Academic does not properly account for soft links. An attacker can create a malicious file as a soft link pointing to a target file, then package this soft link file into a tar.gz file and upload it...