CVE-2024-11449

A vulnerability in haotian-liu/llava version 1.2.0 LLaVA-1.6 allows for Server-Side Request Forgery SSRF through the /run/predict endpoint. An attacker can gain unauthorized access to internal networks or the AWS metadata endpoint by sending crafted requests that exploit insufficient validation o...

CVE-2025-0694

Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access...

CVE-2025-0694

CVE-2025-0694 affects CODESYS Control: insufficient path validation leads to a path traversal flaw that can grant a low-privileged attacker with physical access full filesystem access. The vulnerability is described across multiple feeds (NVD, Red Hat, CVE list) as a removable-media/path traversa...

CVE-2025-0694 CODESYS Control V3 removable media path traversal

Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access...

PT-2025-11585

Name of the Vulnerable Software and Affected Versions CODESYS Control affected versions not specified Description The issue is related to insufficient path validation, which allows low-privileged attackers with physical access to gain full filesystem access. Recommendations At the moment, there i...

CODESYS Control 路径遍历漏洞

CODESYS Control is a suite of industrial control program programming software from CODESYS, Germany. CODESYS Control suffers from a path traversal vulnerability that stems from insufficient path validation, which could allow a low-privileged attacker to gain full file system access...

CVE-2025-0694: Improper Limitation of a Pathname to a Restricted Directory

Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access...

Semantic Segmentation Editor 1.6.0 Directory Traversal

Semantic Segmentation Editor version 1.6.0 suffers from multiple directory traversal vulnerabilities. Exploit Title: Semantic Segmentation Editor 1.6.0 - Directory Traversal File Upload Date: 2025-03-14 Exploit Author: Fatih Türüt defendzero.com Vendor Homepage: Hitachi Automotive & Industry Lab...

Path Traversal via Symbolic Links in `ObsidianReader`

Description The ObsidianReader class, designed to parse Obsidian vaults, contains a critical security flaw that allows arbitrary file read through symbolic links symlinks. When processing a vault, the reader does not resolve or validate the absolute paths of files, enabling an attacker to place a...

WordPress plugin CS Framework 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

PT-2025-10054

Name of the Vulnerable Software and Affected Versions CS Framework plugin for WordPress versions up to and including 6.9 Description The issue arises from insufficient file path validation in the cs widget file delete function, allowing authenticated attackers with Subscriber-level access or high...

PT-2025-9911

Name of the Vulnerable Software and Affected Versions Moving Media Library plugin for WordPress versions up to, and including, 1.22 Description The issue arises from insufficient file path validation in the generate json page function, allowing authenticated attackers with Administrator-level...

CVE-2024-13780

The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the hmenudeletemenu function in all versions up to, and including, 1.16.5. This makes it possible for unauthenticated attackers to delete...

CVE-2024-13780 Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Directory Deletion

The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the hmenudeletemenu function in all versions up to, and including, 1.16.5. This makes it possible for unauthenticated attackers to delete...

CVE-2024-13780

CVE-2024-13780 refers to the Hero Mega Menu - Responsive WordPress Menu Plugin (

WordPress plugin Hero Mega Menu 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

CVE-2024-13910

The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'databasebackupajaxdelete' function in all versions up to, and including, 2.35. This makes it possible for authenticated...

PT-2025-8928

Name of the Vulnerable Software and Affected Versions The Car Dealer Automotive WordPress Theme versions up to, and including, 1.6.3 Description The issue allows authenticated attackers with Subscriber-level access and above to delete arbitrary files on the server due to insufficient file path...

PT-2025-8690 · Mautic +1 · Mautic/Core

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A file placement issue exists, allowing assets to be uploaded to unintended server directories. This is due to improper limitation of a pathname to a restricted directory, specifically in th...

Path Traversal

github.com/clidey/whodb/core is vulnerable to Path Traversal. The vulnerability is due to improper path validation due to the lack of checks when joining user-controlled database file names with the default directory, allowing an attacker to use path traversal ../../ to access any Sqlite3 databas...