CVE-2025-46568

Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Prior to version 0.45.0, Stirling-PDF is vulnerable to SSRF-induced arbitrary file read. WeasyPrint redefines a set of HTML tags, including img, embed, object, and others. The references t...

PT-2025-29480 · Gnu · Snappy

Уязвимость библиотеки PHP Snappy связана с неверным ограничением имени пути к каталогу с ограниченным доступом. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, получить несанкционированный доступ к локальным файлам и директориям на сервере при обработке параметров...

Nextcloud: Calendar attachments of local files are offered to downloaded

A security vulnerability in calendar attachments of local files was discovered, where users were offered to download the attachments...

Medium: evolution

Issue Overview: An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary non-RFC6068 "mailto?attach=..." parameter, a website or other source of mailto links can make Evolution attach local files or directories to a composed email message without showing a warning to th...

CVE-2025-3572

SmartRobot from INTUMIT has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to probe internal network and even access arbitrary local files on the server...

CVE-2025-3572 INTUMIT SmartRobot - Server-Side Request Forgery

SmartRobot from INTUMIT has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to probe internal network and even access arbitrary local files on the server...

PT-2025-16199 · Unknown · Smartrobot

Name of the Vulnerable Software and Affected Versions: SmartRobot versions prior to 8.0.0 Description: The issue allows unauthenticated remote attackers to probe the internal network and access arbitrary local files on the server. This is a Server-Side Request Forgery vulnerability...

CVE-2025-1781

There is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce server-side request forgery SSRF. This could be exploited to read arbitrary local files if an attacker has access to exception messages...

CVE-2025-1781

The CVE-2025-1781 entry affects the W3CSS Validator, where an XXE flaw in versions before cssval-20250226 allows an attacker to coerce SSRF via specially crafted XML objects and, if exception messages are accessible, read arbitrary local files. Affected component is the W3CSS Validator’s XML pars...

CVE-2024-45480

CVE-2024-45480 concerns B&R APROL’s AprolCreateReport component (versions before 4.4-00P5). The flaw is described as improper control of code generation, enabling an unauthenticated, network-based attacker to read local system files (code injection-related exposure) with high impact on confidenti...

PYSEC-2025-83

A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by sending a crafted POST request to the /read-examples endpoint...

Linux Distros Unpatched Vulnerability : CVE-2024-47515

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in Pagure. Support of symbolic links during repository archiving of repositories allows the disclosure of local files. This flaw allow...

Information Exposure

Overview unstructured is an A library that prepares raw documents for downstream ML tasks. Affected versions of this package are vulnerable to Information Exposure when the filetype supports an include functionality, it is possible to partition arbitrary local files. This vulnerability specifical...

CVE-2025-1686

Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates that leverage this tag to include files...

CVE-2025-1686

Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates that leverage this tag to include files...

Pebble 安全漏洞

Pebble is a Java template engine open-sourced by PebbleTemplates. A security vulnerability exists in Pebble that stems from easy external control of file names or paths via include tags, which allows an elevated-privilege attacker to access sensitive local files by crafting malicious notification...

CVE-2025-24787

WhoDB is an open source database management tool. In affected versions the application is vulnerable to parameter injection in database connection strings, which allows an attacker to read local files on the machine the application is running on. The application uses string concatenation to build...

CVE-2022-1721

Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5. Read local files of the web application...

CVE-2024-3572

The scrapy/scrapy project is vulnerable to XML External Entity XXE attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, ...

S3Proxy 路径遍历漏洞

S3Proxy is an S3 API from the individual developer Andrew Gaul. A path traversal vulnerability exists in S3Proxy versions prior to 2.6.0, which stems from the fact that the filesystem and filesystem-nio2 storage backends may inadvertently expose local files to users...