CVE-2026-103533

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...

CVE-2026-103533 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...

CVE-2026-103533 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...

CVE-2026-103533

A path traversal vulnerability exists in the database-servers API Endpoint of David-Crty databasement versions up to 1.7.1 . The flaw is located in the app/Http/Requests/Api/V1/RestoreRequest.php file and stems from the improper handling of the schema_name argument. An attacker can potentially la...

EUVD-2026-90463

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...

CVE-2026-103533 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...

Exploit for Incorrect Implementation of Authentication Algorithm in Vmware Vcenter_Server

VC-Strike VMware vCenter Integrated Authorization Penetrati...

PT-2026-103662

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schema name resul...

PT-2026-104026

Name of the Vulnerable Software and Affected Versions Johnson Controls EasyIO FS32 versions prior to 3.0b63 Description An External Control of File Name or Path issue allows a path traversal attack. This occurs when the software does not properly validate user-supplied input used to construct a...

VulnCheck KEV: CVE-2025-11913

A vulnerability has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. Affected by this vulnerability is the function Download of the file /Service.do?Action=Download. Such manipulation of the argument Path leads to path traversal. The attack can be launched remotely. The exploit h...

PT-2026-103822

Name of the Vulnerable Software and Affected Versions Ghost versions 6.14.0 through 6.26.x Description The ImageSize service contains a path traversal issue where insufficient input validation of user-supplied file paths allows authenticated staff users to access local files located outside the...

PT-2026-103912

Name of the Vulnerable Software and Affected Versions Prime Mover plugin for WordPress versions prior to 2.2.1 Description Authenticated administrators can delete arbitrary directories by importing a specially crafted WPRIME/TAR package. The issue stems from insufficient path validation within th...

CVE-2026-51884

The Langchain Chatchat 0.3.1 software contains a path traversal vulnerability in the /knowledge_base/upload_temp_docs temporary document upload endpoint. An attacker can exploit this by crafting malicious filenames to write files to arbitrary locations on the server, effectively bypassing intende...

PT-2026-105517

Summary /api/file/getUniqueFilename takes a path from the request body and passes it to a filesystem existence check with no validation, confinement or authorization. The response distinguishes paths that exist from paths that do not, so an anonymous reader in publish mode can probe arbitrary...

CVE-2026-51874

In Devika v1.0, the Patcher Agent savecodetoproject function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace...

CVE-2026-51880

deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot workspace...

PT-2026-104040

Name of the Vulnerable Software and Affected Versions Langchain-Chatchat version 0.3.0 Description The OpenAI-compatible file upload endpoint /v1/files is susceptible to path traversal, a condition where an attacker can access or write files outside the intended directory. By crafting malicious...

PT-2026-104033

Name of the Vulnerable Software and Affected Versions Devika version 1.0 Description The Patcher Agent save code to project function contains a path traversal flaw. This issue allows attackers to write files outside the intended project workspace by manipulating file paths. Recommendations As a...

PT-2026-104041

The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences such as .. into the knowledge base name parameter to write knowledge base content to arbitrary locations outside the...

PT-2026-103970

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway versions prior to 9.4.1 Description A maximum severity flaw allows unauthenticated remote attackers to execute arbitrary code and gain root control of the appliance. The issue results from a chain of missing...