CVE-2025-27079

A vulnerability in the file creation process on the command line interface of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to perform remote code execution RCE. Successful exploitation could allow an attacker to execute arbitrary operating system commands on the...

CVE-2025-27079 Arbitrary File Creation vulnerability allows for Authenticated Remote Code Execution in CLI Interface

A vulnerability in the file creation process on the command line interface of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to perform remote code execution RCE. Successful exploitation could allow an attacker to execute arbitrary operating system commands on the...

CVE-2025-27079 Arbitrary File Creation vulnerability allows for Authenticated Remote Code Execution in CLI Interface

A vulnerability in the file creation process on the command line interface of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to perform remote code execution RCE. Successful exploitation could allow an attacker to execute arbitrary operating system commands on the...

CVE-2025-32370: Hidden Functionality

Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProviderSafe, there is additional functionality to create files with other extensions. NOTE: this is a separate issue not...

CVE-2025-1865

The kernel driver, accessible to low-privileged users, exposes a function that fails to properly validate the privileges of the calling process. This allows creating files at arbitrary locations with full user control, ultimately allowing for privilege escalation to SYSTEM...

CVE-2025-1865 Local Privilege Escalation in Virtual CloneDrive Kernel Driver

The kernel driver, accessible to low-privileged users, exposes a function that fails to properly validate the privileges of the calling process. This allows creating files at arbitrary locations with full user control, ultimately allowing for privilege escalation to SYSTEM...

Security Bulletin: IBM Workload Scheduler is vulnerable to arbitrary file creation vulnerability due to CVE-2022-22369 affecting JLOG component

Summary The Jlog component on the Master Domain Manager of IBM Workload Scheduler permits an unauthenticated user to interact with the system making it possible to modify the way the service works or modify system files. Vulnerability Details CVEID:CVE-2022-22369 DESCRIPTION: IBM Workload...

GHSA-JMGM-GX32-VP4W LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions

A vulnerability in the defaultjsonalyzer function of the JSONalyzeQueryEngine in the run-llama/llamaindex repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service DoS attacks. The vulnerability affects the latest version and is fixed...

LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions

A vulnerability in the defaultjsonalyzer function of the JSONalyzeQueryEngine in the run-llama/llamaindex repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service DoS attacks. The vulnerability affects the latest version and is fixed...

CVE-2024-12911

A vulnerability in the defaultjsonalyzer function of the JSONalyzeQueryEngine in the run-llama/llamaindex repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service DoS attacks. The vulnerability affects the latest version and is fixed...

CVE-2024-12911 SQL Injection in run-llama/llama_index

A vulnerability in the defaultjsonalyzer function of the JSONalyzeQueryEngine in the run-llama/llamaindex repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service DoS attacks. The vulnerability affects the latest version and is fixed...

CVE-2024-12911

CVE-2024-12911 affects the run-llama/llama_index project, targeting the default_jsonalyzer function in JSONalyzeQueryEngine. The issue enables SQL injection via prompt injection, enabling arbitrary file creation and DoS. The vulnerability is fixed in llama_index version 0.5.1 (and related notes i...

CVE-2024-12911 SQL Injection in run-llama/llama_index

A vulnerability in the defaultjsonalyzer function of the JSONalyzeQueryEngine in the run-llama/llamaindex repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service DoS attacks. The vulnerability affects the latest version and is fixed...

LlamaIndex 安全漏洞

LlamaIndex is a data framework for LLM applications from the LlamaIndex open source. A security vulnerability exists in LlamaIndex that stems from the defaultjsonalyzer function being susceptible to SQL injection attacks, which can lead to arbitrary file creation and denial of service attacks...

CVE-2024-12911: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the defaultjsonalyzer function of the JSONalyzeQueryEngine in the run-llama/llamaindex repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service DoS attacks. The vulnerability affects the latest version and is fixed...

CVE-2025-2449: Improper Limitation of a Pathname to a Restricted Directory

NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of NI FlexLogger. User interaction is required to exploit this vulnerability in that the target must visit ...

PT-2025-11566 · National Instruments · Ni Flexlogger

Name of the Vulnerable Software and Affected Versions: NI FlexLogger affected versions not specified Description: This vulnerability allows remote attackers to create arbitrary files on affected installations of NI FlexLogger. User interaction is required to exploit this vulnerability, as the...

WordPress GPX Viewer 2.2.8 Arbitrary File Creation Exploit

import argparse import requests from requests.sessions import Session import time banner = """ ██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██╗ ██╗ ██╗ ██████╗ ██████╗ ██████╗ █████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗██║ ██║ ███║██╔═████╗██╔════╝ ╚════██╗██╔══██╗ ██║ ██║...

WordPress GPX Viewer 2.2.8 Arbitrary File Creation

WordPress GPX Viewer plugin versions 2.2.8 and below suffer from an arbitrary file creation vulnerability...

PT-2025-16666

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved. The issue is related to the nfsd proc stat init function ignoring the return value of svc proc register. If the procfile creation...