CVE-2018-3724

general-file-server node module suffers from a Path Traversal vulnerability due to lack of validation of currpath, which allows a malicious user to read content of any file with known path...

CVE-2015-9538

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wpnextgengalleyfileread.rb 2024-02-28 10:41:08+00:00| seen| https://t.me/ctinow/195303 2025-10-23 21:12:58+00:00| seen|...

Arbitrary file read vulnerability in cms made simple backend for normal users

CMS Made Simple is an open source content management system. It is built using PHP and Smarty Engine , which separates content , functionality and templates . cms made simple version 2.2.7 version of the background for file preview there is an arbitrary file read vulnerability , an attacker can...

CVE-2017-16786

The CVE-2017-16786 issue affects Meinberg LANTIME Web Configuration Utility on devices with firmware prior to 6.24.004. The vulnerability allows remote, authenticated users with certain privileges to read arbitrary files via (1) the ntpclientcounterlogfile parameter to cgi-bin/mainv2, or (2) vect...

Arbitrary file deletion

Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/apptheme/libs/checkfile.php via $GET'src' or $GET'name'...

CVE-2017-13801

CVE-2017-13801 affects macOS High Sierra before 10.13.1, specifically the Dictionary Widget. The vulnerability arises from a validation issue in the Dictionary Widget component that allows an attacker to read local files when pasted text is used as a search query. Impact is local information disc...

Web Viewer 1.0.0.193 (Samsung SRN-1670D) - Unrestricted File Upload

Web Viewer 1.0.0.193 Samsung SRN-1670D - Unrestricted File Upload Exploit Title: Unrestricted file upload vulnerability - Web Viewer 1.0.0.193 on Samsung SRN-1670D Date: 2017-06-19 Exploit Author: Omar MEZRAG - 0xFFFFFF / www.realistic-security.com Vendor Homepage: https://www.hanwhasecurity.com...

CVE-2017-16524

Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'networksslupload.php' allows remote authenticated attackers to upload and execute arbitrary PHP code via a filename with a .php extension, which is then accessed via a direct request to the...

Unrestricted file upload

Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'networksslupload.php' allows remote authenticated attackers to upload and execute arbitrary PHP code via a filename with a .php extension, which is then accessed via a direct request to the...

CVE-2017-16524

Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'networksslupload.php' allows remote authenticated attackers to upload and execute arbitrary PHP code via a filename with a .php extension, which is then accessed via a direct request to the...

CVE-2017-3934

CVE-2017-3934 affects McAfee Network Data Loss Prevention (NDLP) server v9.3.x. The vulnerability is due to missing HTTP Strict Transport Security (HSTS) state, enabling MITM attackers to access confidential data by reading files on the web server. Descriptions in connected CNVD/NVD entries corro...

WordPress Job Manager Plugin File Read Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Job Manager is one of the task manager plugin. A file read vulnerability exists in versions of the WordPress Job...

CVE-2017-14327

CVE-2017-14327 affects Extreme EXOS 16.x, 21.x, and 22.x, exposing an arbitrary file read vulnerability. The issue allows an administrator (privileges required: HIGH) with local access to read restricted files (confidentiality impact: HIGH; integrity/availability: none). The CVSS vector indicates...

FLIR Thermal Camera FFCPTD - Information Disclosure

FLIR Thermal Camera FFCPTD - Information Disclosure FLIR Systems FLIR Thermal Camera F/FC/PT/D Multiple Information Disclosures Vendor: FLIR Systems, Inc. Product web page: http://www.flir.com Affected version: Firmware version: 8.0.0.64 Software version: 10.0.2.43 Release: 1.4.1, 1.4, 1.3.4 GA,...

CVE-2017-11459

SAP TREX 7.10 allows remote attackers to 1 read arbitrary files via an fget command or 2 write to arbitrary files and consequently execute arbitrary code via an fdir command, aka SAP Security Note 2419592...

CVE-2017-11325

An issue was discovered in Tilde CMS 1.0.1. Arbitrary files can be read via a file=../ attack on actionphp/download.File.php...

CVE-2017-9833

/cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of “../..” using the FILECAMERA variable sent by GET to read files with root privileges. NOTE: multiple third parties report that this is a system-integrator issue e.g., a vulnerability on one type of camera because Boa does not include any...

CVE-2015-5382

program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the alt parameter when uploading a vCard...

eCommerce Shopsoftware XML External Entity Injection Vulnerability

eCommerce Shopsoftware eCommerce Shop Software is an open source online store system. An XML external entity injection vulnerability exists in the api/it-recht-kanzlei/api-it-recht-kanzlei.php file in eCommerce Shopsoftware version 2.0.2.2 rev 10690. An attacker could exploit this vulnerability t...

Apache FOP XML External Entity Injection Vulnerability

Apache FOP Formatting Object Processor is a U.S. Apache Apache Software Foundation by the XSL Formatting Object XSL-FO and output-independent formatting program driven by the print formatting program. It can read the Formatting Object FO tree and render the resulting page to the specified output...