CVE-2021-25405

An improper access control vulnerability in ScreenOffActivity in Samsung Notes prior to version 4.2.04.27 allows untrusted applications to access local files...

CVE-2021-25337

Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files...

CVE-2021-25363

An improper access control in ActivityManagerService prior to SMR APR-2021 Release 1 allows untrusted applications to access running processesdelete some local files...

CVE-2021-43609

An issue was discovered in Spiceworks Help Desk Server before 1.3.3. A Blind Boolean SQL injection vulnerability within the orderbyforticket function in app/models/reporting/databasequery.rb allows an authenticated attacker to execute arbitrary SQL commands via the sort parameter. This can be...

CVE-2020-14160

An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion, which results in a remote attacker being able to read local files or fetch intranet resources...

CVE-2020-29556

The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection...

CVE-2012-6652

Directory traversal vulnerability in pageflipbook.php script from index.php in Page Flip Book plugin for WordPress wppageflip allows remote attackers to include and execute arbitrary local files via a .. dot dot in the pageflipbooklanguage parameter...

CVE-2010-1059

Directory traversal vulnerability in staff/app/common.inc.php in Phpkobo Address Book Script 1.09, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the LANGCODE parameter. NOTE: the provenance of this...

VulnCheck KEV: CVE-2025-47696

A vulnerability exists in the WordPress Blog Designer PRO for WordPress plugin that allows for disclosure of sensitive local files such as those that are used to store credentials...

SUSE CVE-2025-22247

VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to trigger insecure file operations within that VM...

DEBIAN-CVE-2025-22247

VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to trigger insecure file operations within that VM...

VMware Tools 安全漏洞

VMware Tools is an enhancement tool that comes with VMWare virtual machines from VMware, Inc. It is a driver provided by VMware to enhance the performance of virtual graphics cards and hard disks, as well as to synchronize the clocks of the virtual machine with the host computer. A security...

CVE-2025-46568

Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Prior to version 0.45.0, Stirling-PDF is vulnerable to SSRF-induced arbitrary file read. WeasyPrint redefines a set of HTML tags, including img, embed, object, and others. The references t...

PT-2025-29480 · Gnu · Snappy

Уязвимость библиотеки PHP Snappy связана с неверным ограничением имени пути к каталогу с ограниченным доступом. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, получить несанкционированный доступ к локальным файлам и директориям на сервере при обработке параметров...

Nextcloud: Calendar attachments of local files are offered to downloaded

A security vulnerability in calendar attachments of local files was discovered, where users were offered to download the attachments...

Medium: evolution

Issue Overview: An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary non-RFC6068 "mailto?attach=..." parameter, a website or other source of mailto links can make Evolution attach local files or directories to a composed email message without showing a warning to th...

CVE-2025-3572

SmartRobot from INTUMIT has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to probe internal network and even access arbitrary local files on the server...

CVE-2025-3572 INTUMIT SmartRobot - Server-Side Request Forgery

SmartRobot from INTUMIT has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to probe internal network and even access arbitrary local files on the server...

PT-2025-16199 · Unknown · Smartrobot

Name of the Vulnerable Software and Affected Versions: SmartRobot versions prior to 8.0.0 Description: The issue allows unauthenticated remote attackers to probe the internal network and access arbitrary local files on the server. This is a Server-Side Request Forgery vulnerability...

CVE-2025-1781

The CVE-2025-1781 entry affects the W3CSS Validator, where an XXE flaw in versions before cssval-20250226 allows an attacker to coerce SSRF via specially crafted XML objects and, if exception messages are accessible, read arbitrary local files. Affected component is the W3CSS Validator’s XML pars...