CVE-2024-10098

The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them and any private information they contain...

PT-2025-21806 · Unknown · Projectworlds Life Insurance Management System

Name of the Vulnerable Software and Affected Versions: Projectworlds Life Insurance Management System version 1.0 Description: A critical issue affects some unknown functionality of the file /deleteAgent.php, where the manipulation of the agent id argument leads to SQL injection. This issue can b...

PT-2025-21769 · Unknown · Campcodes Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: Campcodes Sales and Inventory System version 1.0 Description: A critical issue was found in the system, affecting some unknown functionality of the file /pages/supplier update.php. The manipulation of the Name argument leads to SQL injection...

CVE-2025-47794

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1, an attacker on a multi-user system may read temporary files from Nextcloud...

CVE-2025-47794 Nextcloud Server vulnerable to insecure temporary file creation, race with write access and permission

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1, an attacker on a multi-user system may read temporary files from Nextcloud...

CVE-2025-4211

Improper Link Resolution Before File Access 'Link Following' vulnerability in QFileSystemEngine in the Qt corelib module on Windows which potentially allows Symlink Attacks and the use of Malicious Files. Issue originates from CVE-2024-38081. The vulnerability arises from the use of the GetTempPa...

CVE-2025-40629 Path Traversal vulnerability in PNETLab

PNETLab 4.2.10 does not properly sanitize user inputs in its file access mechanisms. This allows attackers to perform directory traversal by manipulating file paths in HTTP requests. Specifically, the application is vulnerable to requests that access sensitive files outside the intended directory...

CVE-2025-40629 Path Traversal vulnerability in PNETLab

PNETLab 4.2.10 does not properly sanitize user inputs in its file access mechanisms. This allows attackers to perform directory traversal by manipulating file paths in HTTP requests. Specifically, the application is vulnerable to requests that access sensitive files outside the intended directory...

Arbitrary File Access

getkirby/cms is vulnerable to Arbitrary File Access. The vulnerability is due to missing path traversal checks in the snippet helper or $kirby-snippet method when used with dynamic snippet names, allowing attackers to access and execute arbitrary PHP files on the server...

PNETLab 路径遍历漏洞

PNETLab is a platform from PNETLab Inc. that allows labs to be downloaded and shared with the community. A path traversal vulnerability exists in PNETLab version 4.2.10, which stems from improper user input cleanup in the file access mechanism and could lead to a directory traversal attack...

PT-2025-21651

Name of the Vulnerable Software and Affected Versions Qt versions prior to 5.15.19 Qt versions 6.0.0 through 6.5.8 Qt versions 6.6.0 through 6.8.1 Description An improper link resolution issue exists in QFileSystemEngine within the Qt corelib module on Windows. This flaw arises from the use of th...

PT-2025-21644 · Pnetlab · Pnetlab

Name of the Vulnerable Software and Affected Versions: PNETLab version 4.2.10 Description: The issue arises from the application's failure to properly sanitize user inputs in its file access mechanisms, allowing attackers to perform directory traversal by manipulating file paths in HTTP requests...

PT-2025-21764 · Unknown · Phpgurukul Human Metapneumovirus Testing Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Human Metapneumovirus Testing Management System version 1.0 Description: A critical issue has been found in the system, affecting the processing of the file /profile.php. The manipulation of the mobilenumber argument leads to SQL...

Security advisory: Improper Link Resolution Before File Access in QFileSystemEngine in the Qt corelib module on Windows impacts Qt

Improper Link Resolution Before File Access 'Link Following' vulnerability in QFileSystemEngine in the Qt corelib module on Windows potentially allows Symlink Attacks and the use of Malicious Files. This vulnerability has been discovered and assigned the CVE ID CVE-2025-4211. The issue originates...

PT-2025-21604 · Unknown · Campcodes Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: Campcodes Sales and Inventory System version 1.0 Description: A critical vulnerability has been found in the Campcodes Sales and Inventory System. This issue affects the file /pages/purchase delete.php and is related to SQL injection. The...

PT-2025-21616 · D Link · D-Link Di-7003Gv2

Name of the Vulnerable Software and Affected Versions: D-Link DI-7003GV2 version 24.04.18D1 R68125 Description: A vulnerability has been found in the D-Link DI-7003GV2, affecting an unknown functionality of the file /install base.data. The manipulation leads to information disclosure. The attack...

PT-2025-21621 · D Link · D-Link Di-7003Gv2

Name of the Vulnerable Software and Affected Versions: D-Link DI-7003GV2 version 24.04.18D1 R68125 Description: A critical issue has been found, affecting the function sub 497DE4 of the file /H5/netconfig.asp. This leads to improper authentication. The attack can be initiated remotely...

PT-2025-21662 · Nextcloud · Nextcloud Enterprise Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 29.0.13, 30.0.7, and 31.0.1 Nextcloud Enterprise Server versions prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1 Description: The issue allows an attacker on a multi-user system to re...

CVE-2025-43563

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify sensitive data without proper authorization. Exploitation of this...

CVE-2024-9765 EKC Tournament Manager < 2.2.2 - Local File Download Vulnerability

The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directory...