7508 matches found
Exploit for CVE-2025-49493
CVE-2025-49493 Akamai CloudTest - XXE Injection ☁️ 📄 Descr...
SQL Injection
Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to SQL Injection via the /key/block endpoint. A proxyadminviewer user can retrieve the contents of arbitrary files on the target filesystem by brute forcing them one character...
Microweber CMS API has authenticated local file inclusion vulnerability
An authenticated local file inclusion vulnerability exists in Microweber CMS versions 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By specifyi...
CVE-2025-34076
An authenticated local file inclusion vulnerability exists in Microweber CMS versions = 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By...
PT-2025-27668
Name of the Vulnerable Software and Affected Versions: Microweber CMS versions = 1.2.11 Description: An authenticated local file inclusion issue exists due to the misuse of the backup management API. Authenticated users can exploit the /api/BackupV2/upload and /api/BackupV2/download endpoints to...
CVE-2025-34076: Improper Limitation of a Pathname to a Restricted Directory
An authenticated local file inclusion vulnerability exists in Microweber CMS versions = 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By...
Directory Traversal
Overview dbgpt is a DB-GPT is an experimental open-source project that uses localized GPT large models to interact with your data and environment. With this solution, you can beassured that there is no risk of data leakage, and your data is 100% private and secure. Affected versions of this packa...
Allure Report allows Improper XXE Restriction via DocumentBuilderFactory
Summary A critical XML External Entity XXE vulnerability exists in the xunit-xml-plugin used by Allure 2. The plugin fails to securely configure the XML parser DocumentBuilderFactory and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitra...
GHSA-H7QF-QMF3-85QG Allure Report allows Improper XXE Restriction via DocumentBuilderFactory
Summary A critical XML External Entity XXE vulnerability exists in the xunit-xml-plugin used by Allure 2. The plugin fails to securely configure the XML parser DocumentBuilderFactory and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitra...
Directory Traversal
Overview DotVVM is an open source ASP.NET-based framework which allows to build interactive web apps easily by using mostly C and HTML. Affected versions of this package are vulnerable to Directory Traversal via the FileResourceLocation process in Debug mode. An attacker can access sensitive file...
Lychee 路径遍历漏洞
Lychee is a beautiful and easy to use photo management system open-sourced by The Lychee Organisation. It is used to manage and share photos. A path traversal vulnerability exists in Lychee versions prior to 6.6.6 through 6.6.10, which stems from path traversal and could lead to local file...
Hemi VDP: WordPress Version Exposure via ███████ on hemi.xyz
The WordPress CMS version was exposed in the XML file at https://hemi.xyz███. This disclosure allowed attackers to fingerprint the CMS version...
CVE-2025-40591
A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions V2.16.5, RUGGEDCOM ROX MX5000RE All versions V2.16.5, RUGGEDCOM ROX RX1400 All versions V2.16.5, RUGGEDCOM ROX RX1500 All versions V2.16.5, RUGGEDCOM ROX RX1501 All versions V2.16.5, RUGGEDCOM ROX RX1510 All versions V2.16.5...
Siemens多款产品 安全漏洞
Siemens RUGGEDCOM ROX MX5000 and others are products of Siemens, Germany Siemens.Siemens RUGGEDCOM ROX MX5000 is a communication device.Siemens RUGGEDCOM ROX RX1400 is a communication device.Siemens RUGGEDCOM ROX MX5000RE is a communication device. A security vulnerability exists in various Sieme...
Keyoti SearchUnit 安全漏洞
Keyoti SearchUnit is a web search engine from Keyoti Canada. A security vulnerability exists in Keyoti SearchUnit versions prior to 9.0.0 that stems from an XML external entity issue that could lead to an operating system file disclosure...
OctoPrint 安全漏洞
OctoPrint is an open source application from OctoPrint. It provides a fast web interface for controlling consumer 3D printers. A security vulnerability exists in OctoPrint 1.11.1 and earlier versions, which stems from improper file upload permissions and could lead to file disclosure...
VulnCheck KEV: CVE-2023-23063
Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetFileContent.cgi...
CVE-2025-48781
An external control of file name or path vulnerability in the download file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to obtain partial files by specifying arbitrary file paths...
Unauthorized File Disclosure
mcp-markdownify-server is vulnerable to Unauthorized File Disclosure. The vulnerability is due to improper access control due to the get-markdown-file tool allowing external prompts to read arbitrary files from the host system...
