CVE-2026-97356

External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABELMANAGERVIEW permission to read arbitrary properties and xml files on the server, including the generated JWT...

CVE-2026-97356

Apache OFBiz version 24.09.07 is vulnerable to an External Control of File Name or Path vulnerability in the ViewFile component of Label Manager . An authenticated user with the LABEL_MANAGER_VIEW permission can exploit the fileName parameter to read arbitrary properties and XML files on the serv...

CVE-2026-97356 Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass

External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABELMANAGERVIEW permission to read arbitrary properties and xml files on the server, including the generated JWT...

CVE-2026-63130

EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows traversal outside the intended directory and permits reading, modifying,...

EUVD-2026-102108

EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows traversal outside the intended directory and permits reading, modifying,...

CVE-2026-63130

EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows traversal outside the intended directory and permits reading, modifying,...

PT-2026-114963

EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows traversal outside the intended directory and permits reading, modifying,...

CVE-2026-63130: Improper Limitation of a Pathname to a Restricted Directory

EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows traversal outside the intended directory and permits reading, modifying,...

CVE-2017-5990

An issue was discovered in PhreeBooksERP before 2017-02-13. The vulnerability exists due to insufficient filtration of user-supplied data in the "form" HTTP GET parameter passed to the "PhreeBooksERP-master/extensions/ShippingMethods/ups/labelmgr/jsinclude.php" and...

PhreeBooks R30RC4 Cross Site Scripting

------------------------------------------------------------------------ Software................PhreeBooks R30RC4 Vulnerability...........Reflected Cross-site Scripting Download................http://sourceforge.net/projects/phreebooks Release Date............2/22/2011 Tested...