Alist vulnerable to Path Traversal in multiple file operation handlers

Summary The application contains a Path Traversal vulnerability CWE-22 in multiple file operation handlers. An authenticated attacker can bypass directory-level authorisation by injecting traversal sequences into filename components, enabling unauthorised file removal, movement and copying across...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the FsRemove and FsCopy functions. An attacker can access and manipulate files outside of their authorized directory by injecting traversal sequences into filename components. This allows unauthorized file remova...

CVE-2018-1000208

MODX Revolution version =2.6.4 contains a Directory Traversal vulnerability in /core/model/modx/modmanagerrequest.class.php that can result in remove files. This attack appear to be exploitable via web request via security/login processor. This vulnerability appears to have been fixed in pull 139...

CVE-2019-20390

A Cross-Site Request Forgery CSRF vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a victim's knowledge, by enticing an authenticated user to visit an attacker's web page. The application fails to validate the CSRF token for a G...

WordPress plugin WP Cost Estimation 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

PT-2026-21547

Name of the Vulnerable Software and Affected Versions evolution-data-server versions 22.04 through 25.10 Description The software contains a flaw related to insecure local cache file removal. This could allow for unauthorized access or modification of cached data. Recommendations Update to a newe...

CVE-2025-13564

Affected product: SourceCodester Pre-School Management System 1.0. The vulnerability is in the function removefile of app/controllers/FilehelperController.php; manipulating the filepath argument can cause denial of service. Exploitation is described as remote with public exploit released. Multipl...

Malicious code in perfviewer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ea912a2de677fa6d9ea6dbf9a792dace4d927efd46a5cb615ba8548fec4930e8 During installation, code downloads and starts an executable and a DLL library. After starting them, files are removed from the disk. The executable has been...

UBUNTU-CVE-2025-40006

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix folio is still mapped when deleted Migration may be raced with fallocating hole. removeinodesinglefolio will unmap the folio if the folio is still mapped. However, it's called without folio lock. If the folio is...

EUVD-2012-0968

Malware in sbrugna...

EUVD-2018-2932

Malware in sbrugna...

EUVD-2021-11289

Malware in sbrugna...

EUVD-2018-1880

Malware in sbrugna...

EUVD-2025-6796

Malicious code in bioql PyPI...

EUVD-2022-3510

Malicious code in bioql PyPI...

EUVD-2024-39885

Malicious code in bioql PyPI...

EUVD-2024-29051

Malicious code in bioql PyPI...

EUVD-2022-30303

Malicious code in bioql PyPI...

EUVD-2024-38203

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2025-23024

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. Starting in version 0.72 and prior to version 10.0.18, an anonymous user can disable all the active...