CVE-2025-46568

CVE-2025-46568 affects Stirling-PDF prior to version 0.45.0. The vulnerability arises from SSRF-induced arbitrary file read due to WeasyPrint redefining HTML tags (e.g., img, embed, object). References to internal files allow attaching content from any webpage or local file to a PDF, enabling an ...

CVE-2025-46568 Stirling-PDF Server-Side Request Forgery (SSRF)-Induced Arbitrary File Read Vulnerability

Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Prior to version 0.45.0, Stirling-PDF is vulnerable to SSRF-induced arbitrary file read. WeasyPrint redefines a set of HTML tags, including img, embed, object, and others. The references t...

CVE-2025-46568 Stirling-PDF Server-Side Request Forgery (SSRF)-Induced Arbitrary File Read Vulnerability

Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Prior to version 0.45.0, Stirling-PDF is vulnerable to SSRF-induced arbitrary file read. WeasyPrint redefines a set of HTML tags, including img, embed, object, and others. The references t...

CVE-2025-46568 Stirling-PDF Server-Side Request Forgery (SSRF)-Induced Arbitrary File Read Vulnerability

Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Prior to version 0.45.0, Stirling-PDF is vulnerable to SSRF-induced arbitrary file read. WeasyPrint redefines a set of HTML tags, including img, embed, object, and others. The references t...

PT-2025-18685

Name of the Vulnerable Software and Affected Versions Stirling-PDF versions prior to 0.45.0 Description Stirling-PDF is a locally hosted web application that allows users to perform various operations on PDF files. The application is vulnerable to SSRF-induced arbitrary file read due to WeasyPrin...

PT-2025-18289 · Joplin · Joplin

Name of the Vulnerable Software and Affected Versions: Joplin versions prior to 3.3.3 Description: The issue allows path traversal in Joplin Server when the static file path starts with css/pluginAssets or js/pluginAssets. The findLocalFile function in the default route calls localFileFromUrl to...

Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a cri-o security vulnerability (CVE-2024-5154)

Summary Red Hat OpenShift on IBM Cloud is affected by a security vulnerability found in the cri-o component which could allow an attacker to send a specially crafted URL request containing "dot dot" sequences /../ to read and write arbitrary files on the system. Vulnerability Details CVEID:...

GNU Mailman Directory Traversal Vulnerability (CNVD-2025-09675)

GNU Mailman is a free suite of software for managing email discussions and email lists from the GNU community in the United States. GNU Mailman suffers from a directory traversal vulnerability that originates from a directory traversal that results in arbitrary file reads. An attacker could use t...

CVE-2025-28099

opencms V2.3 is vulnerable to Arbitrary file read in src/main/webapp/view/admin/document/dataPage.jsp,...

CVE-2025-3295

The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the affected site's server which may reveal sensitive...

CVE-2025-24910

Overview XML documents optionally contain a Document Type Definition DTD, which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the content of the URI is read, it is fed back into the...

CVE-2025-3103

The CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon plugin for WordPress is vulnerable to arbitrary file read due to insufficient file path validation in the 'history.php' file in all versions up to, and including, 2.4. This makes it possible for...

CVE-2025-1565

The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.4.1 via the library/wave-audio/peaks/remotedl.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Checkpoint Quantum_Spark_Firmware

🛡️ SOC287 - Arbitrary File Read on Checkpoint Security Gateway...

CVE-2025-1565 Mayosis Core <= 5.4.1 - Unauthenticated Arbitrary File Read

The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.4.1 via the library/wave-audio/peaks/remotedl.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

CVE-2025-1565 Mayosis Core <= 5.4.1 - Unauthenticated Arbitrary File Read

The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.4.1 via the library/wave-audio/peaks/remotedl.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

CVE-2025-1565

CVE-2025-1565 concerns the Mayosis Core WordPress plugin (versions ≤ 5.4.1). An Arbitrary File Read via library/wave-audio/peaks/remote_dl.php allows unauthenticated attackers to read server files containing sensitive data. Public advisories from Red Hat, NVD, CVE listings, and Patchstack corrobo...

WordPress plugin Mayosis Core 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-17897 · WordPress · Mayosis Core

Name of the Vulnerable Software and Affected Versions: Mayosis Core plugin for WordPress versions up to, and including, 5.4.1 Description: The issue allows unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information, via the...

CVE-2025-3300 WPMasterToolKit (WPMTK) – All in one plugin <= 2.5.2 - Authenticated (Administrator+) to Arbitrary File Read and Write

The WPMasterToolKit WPMTK – All in one plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to read and modify the contents of arbitrary files on...