CVE-2026-81937 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the import remotelogconfig file CLI command. A highly privileged authenticated user can inject shell commands through the filename parameter, potentially resulting in arbitrary command execution with root...

CVE-2026-16777

The Store Exporter WordPress plugin (for WooCommerce) is affected by a directory traversal vulnerability in all versions up to and including 2.8.0 . The flaw resides in the filename parameter , which is insufficiently validated, allowing authenticated attackers with Shop Manager privileges or hig...

PT-2026-95288

Name of the Vulnerable Software and Affected Versions The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers versions prior to 2.8.1 Description A Directory Traversal issue exists where authenticated attackers with shop manager-level access or higher can read arbitrary...

PT-2026-95629

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An issue exists in the import remotelog config file CLI command where a highly privileged authenticated user can inject shell commands through the filename parameter. This can lead to...

CVE-2026-93014

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...

CVE-2026-93014 RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...

EUVD-2026-81683

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...

CVE-2026-93014 RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...

CVE-2026-92748

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicio...

CVE-2026-92748 BC Security Empire before 6.7.1 Path Traversal File Upload RCE

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicio...

CVE-2026-92748

BC Security Empire before version 6.7.1 contains a path traversal vulnerability in its upload endpoints. The root cause is a failure to validate the multipart filename parameter , allowing authenticated operators to use path traversal sequences to write files to arbitrary locations on the C2 serv...

EUVD-2026-75323

GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service...

CVE-2026-54732 libreoffice-convert: path traversal / arbitrary file write

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

CVE-2026-54732

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2 , the options.fileName value passed to path.join(tempDir.name, fileName) in index.js is never reduced to a base name. A filename containing ../ allows an attacker to escape the temporary d...

CVE-2026-54732 libreoffice-convert: path traversal / arbitrary file write

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

GHSA-3VFR-4GWF-QXFP Whistle vulnerable to path traversal

This bug was found by nova, which is an automated tool from group of Song Wu, intern, Zhejiang University; BoWang, independent researcher; Xingwei Lin, Zhejiang University. Vulnerability detail: In service.js, inside app.get'/cgi-bin/temp/get', ...: var filename = req.query.filename; if...

PT-2026-78364

Name of the Vulnerable Software and Affected Versions nnn version 5.2 Description The software fails to sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or within an extracted archive. If the filename contains a single quote...

WordPress ProSolution WP Client plugin <= 2.0.8 - Unauthenticated Arbitrary File Deletion via 'newfilename' and 'filename' Parameters vulnerability

Unauthenticated Arbitrary File Deletion via 'newfilename' and 'filename' Parameters vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin ProSolution WP Client versions = 2.0.8...

CVE-2026-75111

Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system...

CVE-2026-75111: Improper Limitation of a Pathname to a Restricted Directory

Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system...