EUVD-2026-66562

IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes...

CVE-2026-54550 IzPack: Path Traversal in UnpackerBase allows writing files outside the installation directory via malicious pack entries

IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes...

CVE-2026-54550

IzPack versions 5.2.6 and earlier contain a path traversal vulnerability in UnpackerBase.unpack(). The method passes an attacker-controlled PackFile targetPath through IoHelper.translatePath(), which only converts separators without normalizing ../ segments or enforcing directory containment. A t...

CVE-2026-73102 RustDesk Path Traversal via macOS Clipboard File-Paste

RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied file descriptor names and joins them to the selected target directory without requiring normalized relative paths. A remote peer in an...

CVE-2026-73102

RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied file descriptor names and joins them to the selected target directory without requiring normalized relative paths, allowing a remote peer...

CVE-2026-73102 RustDesk Path Traversal via macOS Clipboard File-Paste

RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied file descriptor names and joins them to the selected target directory without requiring normalized relative paths. A remote peer in an...

EUVD-2026-66421

RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied file descriptor names and joins them to the selected target directory without requiring normalized relative paths. A remote peer in an...

Vitejs-exploit

Vite Exploit CVE-2025-31125 Beschreibung: Nutzt den Path-Traversal-Schwachstelle im @fs-Endpunkt des Vite Development Servers CVE-2025-31125 aus, um über manipulierte URLs auf sensible Dateien wie /etc/passwd und /etc/hosts zuzugreifen. Erstellt von Muhammad Waseem. Verwendung: python...

CVE-2025-24813

CVE-2025-24813 - Vulnerabilità di Path Equivalence in Apache Tomcat Apache Tomcat è vulnerabile a un problema di Path Equivalence / Path Traversal dovuto alla gestione impropria delle sequenze ../ nei percorsi. ID CVE: CVE-2025-24813 Gravità: Critica Link di riferimento:...

CVE-2022-21371

CVE-2022-21371 Oracle WebLogic Server 12.1.3.0.0 / 12.2.1.3.0 / 12.2.1.4.0 / 14.1.1.0.0 Lokale Dateieinbindung root@kitploit: Exploit Title: Oracle WebLogic Server 12.1.3.0.0 / 12.2.1.3.0 / 12.2.1.4.0 / 14.1.1.0.0 Local File Inclusion Date: 25/1/2022 Exploit Author: Jonah Tan @picar0jsu Vendor...

CVE-2026-18080

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin (versions ≤ 1.17.8) is vulnerable to an unauthenticated arbitrary file upload via the CRM Email Connect IMAP attachment processing. The root cause is missing file extension validation and path normalization in the...

EUVD-2026-66408

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the saveattachments function. This is due to missing file extension validation and missing path normalization whe...

CVE-2026-16444

Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an authenticated remote session participant to write files to unintended locations on the local file system via file transfer or virtual file clipboard mechanisms. An attacker can levera...

CVE-2026-16444

TeamViewer Desktop Clients prior to version 15.81.5 are affected by improper neutralization of path traversal sequences, allowing an authenticated remote session participant to write files to unintended locations on the local file system via file transfer or virtual file clipboard mechanisms. An ...

CVE-2026-16444 Improper Validation of File Paths in TeamViewer Desktop Clients

Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an authenticated remote session participant to write files to unintended locations on the local file system via file transfer or virtual file clipboard mechanisms. An attacker can levera...

CVE-2024-53677-S2-067-thread

Disclaimer Non utilizzare le tecnologie descritte in questo articolo per test illegali. Qualsiasi conseguenza o danno diretto o indiretto derivante dalla diffusione o dall'utilizzo delle informazioni o degli strumenti forniti in questo articolo è di responsabilità dell'utente. Tutte le conseguenz...

CVE-2024-7928

FastAdmin - Exploit della vulnerabilità di Path Traversal Una vulnerabilità, classificata come problematica, è stata trovata in FastAdmin fino alla versione 1.3.3.20220121. Questo problema riguarda una funzionalità sconosciuta del file /index/ajax/lang. La manipolazione dell'argomento lang porta ...

CVE-2020-5902

CVE-2020-5902 Nelle versioni BIG-IP 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1 e 11.6.1-11.6.5.1, la Traffic Management User Interface TMUI, nota anche come utility di configurazione, presenta una vulnerabilità di esecuzione di codice in remoto RCE in pagine non divulgate...

CVE-2019-14530

CVE-2019-14530 Vulnerabilità di path traversal e DoS nel progetto OpenEMR Funzione vulnerabile nel file: /openemr/custom/ajaxdownload.php Condizioni: 1. qualsiasi utente autorizzato 2. per il caso DoS: la directory "/sites/default/documents/cqmqrda/" deve esistere sul server A causa della logica...

Grafana-8.3-Directory-Traversal

CVE-2021-43798 script Python Descrizione: Grafana 8.3.0 Directory Traversal Prova questo se EDB-ID 50581 non funziona! Articolo originale: https://ethicalhacking.uk/cve-2021-43798-dissecting-the-grafana-path-traversal-vulnerability/gsc.tab=0 Durante una macchina in OffSec Proving Ground Fanatasti...