PT-2026-41380

Уязвимость модуля landing сервиса для управления бизнесом Битрикс24 исистемы управления содержимым сайтов CMS 1С-Битрикс: Управление сайтом связана с неверным управлением именами файлов для PHP-функций include или require. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо,...

Photon OS 5.0: Capstone PHSA-2026-5.0-0732

An update of the capstone package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0732. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2023-31284

illumos illumos-gate before 676abcb has a stack buffer overflow in /dev/net, leading to privilege escalation via a stat on a long file name in /dev/net...

CVE-2021-33961

A Cross Site Scripting XSS vulnerabililty exists in enhanced-github v5.0.11 via the file name parameter...

CVE-2022-37076

TOTOLINK A7000R V9.1.0u.6115B20201022 was discovered to contain a command injection vulnerability via the FileName parameter in the function UploadFirmwareFile...

CVE-2024-34852

F-logic DataCube3 v1.0 is affected by command injection due to improper string filtering at the command execution point in the ./admin/transceiverschedule.php file. An unauthenticated remote attacker can exploit this vulnerability by sending a file name containing command injection. Successful...

CVE-2025-69194

A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially...

UBUNTU-CVE-2025-69194

A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially...

CVE-2025-69194

Summary: CVE-2025-69194 is a path-traversal vulnerability in GNU Wget2’s Metalink handling that can cause arbitrary file writes via unnormalized paths. The issue arises from trusting the Metalink name attribute during path resolution, allowing writes to unintended locations and potential further...

CVE-2025-69194 Wget2: arbitrary file write via metalink path traversal in gnu wget2

A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially...

CVE-2025-66003

An External Control of File Name or Path vulnerability in smb4k allowsl ocal users to perform a local root exploit via smb4k mounthelper if they can access and control the contents of a Samba shareThis issue affects smb4k: from ? before 4.0.5...

CVE-2025-66003

An External Control of File Name or Path vulnerability in smb4k allowsl ocal users to perform a local root exploit via smb4k mounthelper if they can access and control the contents of a Samba shareThis issue affects smb4k: from ? before 4.0.5...

CVE-2025-66003 Local users can perform a local root exploit via smb4k mounthelper

An External Control of File Name or Path vulnerability in smb4k allowsl ocal users to perform a local root exploit via smb4k mounthelper if they can access and control the contents of a Samba shareThis issue affects smb4k: from ? before 4.0.5...

CVE-2025-66003: External Control of File Name or Path

An External Control of File Name or Path vulnerability in smb4k allowsl ocal users to perform a local root exploit via smb4k mounthelper if they can access and control the contents of a Samba shareThis issue affects smb4k: from ? before 4.0.5...

Photon OS 4.0: Python3 PHSA-2026-4.0-0939

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-4.0-0939. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2022-27115

In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload...

WordPress plugin Hope has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the loadFile, addImage, html and addFont functions. An attacker can access and include arbitrary files from the local file system into generated PDFs. Workaround This vulnerability can be...

External Control of File Name or Path

Overview jspdf is a PDF Document creation from JavaScript Affected versions of this package are vulnerable to External Control of File Name or Path via the loadFile, addImage, html and addFont functions. An attacker can access and include arbitrary files from the local file system into generated...

CVE-2025-62842

CVE-2025-62842 affects HBS 3 Hybrid Backup Sync. The issue is an external control of file name or path vulnerability. If an attacker gains local network access, they can read or modify files or directories. A fix is available in HBS 3 Hybrid Backup Sync version 26.2.0.938 and later (per multiple ...