2835 matches found
CVE-2025-8998
It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account...
PT-2025-46312
Name of the Vulnerable Software and Affected Versions affected versions not specified Description A flaw exists that allows the upload of files with a specific name to a temporary directory. This can lead to process crashes and reduced usability. Exploitation requires authentication with an...
CVE-2025-8998: External Control of File Name or Path
It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account...
CVE-2025-59511: External Control of File Name or Path
External control of file name or path in Windows WLAN Service allows an authorized attacker to elevate privileges locally...
CVE-2025-20614: External Control of File Name or Path
External control of file name or path for some IntelR CIP software before version WINDCA2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privileg...
PT-2025-46461
Name of the Vulnerable Software and Affected Versions Windows WLAN Service affected versions not specified Description An issue exists in the Windows WLAN Service where external control of a file name or path can be exploited by an authorized attacker to gain elevated privileges locally...
Zoom Workplace VDI Client < 6.3.14 Vulnerability (ZSB-25041)
The version of Zoom Workplace VDI Client installed on the remote host is prior to 6.3.14. It is, therefore, affected by a vulnerability as referenced in the ZSB-25041 advisory. - External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosur...
Zoom Workplace < 6.5.10 Vulnerability (ZSB-25041)
The version of Zoom Workplace installed on the remote host is prior to 6.5.10. It is, therefore, affected by a vulnerability as referenced in the ZSB-25041 advisory. - External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of...
Zoom Workplace < 6.5.10 Vulnerability (ZSB-25041)
The version of Zoom Workplace installed on the remote host is prior to 6.5.10. It is, therefore, affected by a vulnerability as referenced in the ZSB-25041 advisory. - External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of...
Exploit for External Control of File Name or Path in Microsoft
CVE-2025-240...
Red Database parseFileName File Access
The vulnerability of the parseFileName function in the SysFunction.cpp module of the “Red Database” database management system is related to an incorrect limitation on the path name for the directory. Exploiting this vulnerability could allow a malicious actor to gain access to arbitrary files...
WordPress Kleo plugin file inclusion vulnerability
WordPress Kleo plugin is a feature-rich portfolio of themes and plugins in the WordPress ecosystem, primarily used to build social networks, member communities and e-commerce platforms. WordPress Kleo plugin suffers from a file inclusion vulnerability that stems from improper file name control,...
GHSA-J945-QM58-4GJX motionEye vulnerable to RCE via unsanitized motion config parameter
Summary A command injection vulnerability in MotionEye allows attackers to achieve Remote Code Execution RCE by supplying malicious values in configuration fields exposed via the Web UI. Because MotionEye writes user-supplied values directly into Motion configuration files without sanitization,...
Improper Encoding or Escaping of Output
Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the Web UI. An attacker can execute arbitrary system commands by supplying crafted input to configuration fields such as imagefilename and moviefilename, that are written directly to...
EUVD-2025-37543
Malicious code in dowloadebokteufelsbotschaftosterreichkrimimeierhoferssebylisagallauner07297 npm...
WordPress plugin Kleo has a security vulnerability
WordPress Kleo plugin is a feature-rich portfolio of themes and plugins in the WordPress ecosystem, primarily used to build social networks, member communities and e-commerce platforms. WordPress Kleo plugin suffers from a file inclusion vulnerability that stems from improper file name control,...
Photon OS 5.0: Linux PHSA-2025-5.0-0662
An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0662. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Siemens SIMATIC Devices Stack-based Buffer Overflow (CVE-2023-4273)
This vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stac...
Cross-site Scripting (XSS)
io.vertx:vertx-web is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper escaping of file and directory names in generated HTML when directory listing is enabled, which allows an attacker to craft malicious filenames that execute arbitrary scripts in the browser of users...
