CVE-2024-8438: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. The API endpoint /api/file does not properly sanitize the path parameter, allowing an attacker to read arbitrary files on the server...

PT-2025-12190

Name of the Vulnerable Software and Affected Versions h2oai/h2o-3 version 3.46.1 Description A vulnerability in the "/3/ImportFiles" endpoint allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, path, which can be recursively set to reference itself, leading...

CVE-2024-11603: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF vulnerability exists in lm-sys/fastchat version 0.2.36. The vulnerability is present in the /queue/join? endpoint, where insufficient validation of the path parameter allows an attacker to send crafted requests. This can lead to unauthorized access to internal...

CVE-2024-11449: Server-Side Request Forgery (SSRF)

A vulnerability in haotian-liu/llava version 1.2.0 LLaVA-1.6 allows for Server-Side Request Forgery SSRF through the /run/predict endpoint. An attacker can gain unauthorized access to internal networks or the AWS metadata endpoint by sending crafted requests that exploit insufficient validation o...

CVE-2025-25684

A lack of validation in the path parameter /download of GL-INet Beryl AX GL-MT3000 v4.7.0 allows attackers to download arbitrary files from the device's file system via a crafted POST request...

CVE-2025-25684

A lack of validation in the path parameter /download of GL-INet Beryl AX GL-MT3000 v4.7.0 allows attackers to download arbitrary files from the device's file system via a crafted POST request...

GL.iNet Beryl AX GL-MT3000 安全漏洞

GL.iNet Beryl AX GL-MT3000 is a portable WiFi 6 router from China's Guanglian Zhitong GL.iNet. It is used to provide network connectivity and supports 2.5G network ports and a variety of features. A security vulnerability exists in GL.iNet Beryl AX GL-MT3000 version v4.7.0, which stems from...

CVE-2025-25684

A lack of validation in the path parameter /download of GL-INet Beryl AX GL-MT3000 v4.7.0 allows attackers to download arbitrary files from the device's file system via a crafted POST request...

PT-2025-11519

Name of the Vulnerable Software and Affected Versions GL-INet Beryl AX GL-MT3000 version 4.7.0 Description The issue is related to a lack of validation in the path parameter of the "/download" API endpoint, allowing attackers to download arbitrary files from the device's file system via a crafted...

CVE-2025-26014

A Remote Code Execution RCE vulnerability in Loggrove v.1.0 allows a remote attacker to execute arbitrary code via the path parameter...

CVE-2025-26014

A Remote Code Execution RCE vulnerability in Loggrove v.1.0 allows a remote attacker to execute arbitrary code via the path parameter...

PT-2025-7594 · Loggrove · Loggrove

Name of the Vulnerable Software and Affected Versions: Loggrove version 1.0 Description: A Remote Code Execution RCE issue allows a remote attacker to execute arbitrary code via the path parameter. Recommendations: For Loggrove version 1.0, avoid using the path parameter in affected API endpoints...

CVE-2025-26014: Improper Control of Generation of Code

A Remote Code Execution RCE vulnerability in Loggrove v.1.0 allows a remote attacker to execute arbitrary code via the path parameter...

CVE-2025-26014

A Remote Code Execution RCE vulnerability in Loggrove v.1.0 allows a remote attacker to execute arbitrary code via the path parameter...

Loggrove 安全漏洞

Loggrove is a web platform service by olajowon individual developers. A security vulnerability exists in Loggrove v.1.0, which originates from the execution of arbitrary code via the path parameter...

Loggrove 命令注入漏洞

Loggrove is a web platform service by olajowon individual developers. Loggrove suffers from a command injection vulnerability that stems from the path parameter of /read/?page=1&logfile=eee&match= contains an operating system command injection vulnerability...

PT-2025-6706 · Unknown · Yeqifu Carrental

Name of the Vulnerable Software and Affected Versions: yeqifu carRental version 1.0 Description: The issue allows a remote attacker to obtain sensitive information via the "file/downloadFile.action?path=" component. This is a Directory Traversal vulnerability, which can be exploited to access...

CVE-2024-54909

A vulnerability has been identified in GoldPanKit eva-server v4.1.0. It affects the path parameter of the /api/resource/local/download endpoint, where manipulation of this parameter can lead to arbitrary file download...

CVE-2024-54909

A vulnerability has been identified in GoldPanKit eva-server v4.1.0. It affects the path parameter of the /api/resource/local/download endpoint, where manipulation of this parameter can lead to arbitrary file download...

CVE-2024-54909

A path traversal vulnerability exists in GoldPanKit eva-server v4.1.0 affecting the /api/resource/local/download endpoint. An attacker can manipulate the path parameter to achieve arbitrary file download . As a temporary workaround, it is recommended to restrict access to this endpoint or avoid u...