node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

Summary The node-tar library = 7.5.2 fails to sanitize the linkpath of Link hardlink and SymbolicLink entries when preservePaths is false the default secure behavior. This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and...

Local File Inclusion (LFI)

jsPDF is vulnerable to a Local File Inclusion. The vulnerability is due to unsanitized user-controlled file paths passed to file-loading methods in the Node.js build, which allows an attacker to read arbitrary local files and include their contents in generated PDF documents...

CVE-2026-22646

Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attackers with valuable reconnaissance information like file paths, database errors, or software versions that can be used to map the application's internal structu...

CVE-2025-15526

The Fancy Product Designer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 6.4.8. This is due to improper error handling in the PDF upload functionality that exposes server filesystem paths and stack traces in error messages. This makes it possible...

CVE-2025-15526 Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Full Path Disclosure via 'pdf' Parameter

The Fancy Product Designer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 6.4.8. This is due to improper error handling in the PDF upload functionality that exposes server filesystem paths and stack traces in error messages. This makes it possible...

CVE-2021-47791

SmartFTP Client 10.0.2909.0 contains multiple denial of service vulnerabilities that allow attackers to crash the application through specific input manipulation. Attackers can trigger crashes by entering malformed paths, using invalid IP addresses, or clearing connection history in the client's...

CVE-2021-47791

SmartFTP Client 10.0.2909.0 contains multiple denial of service vulnerabilities that allow attackers to crash the application through specific input manipulation. Attackers can trigger crashes by entering malformed paths, using invalid IP addresses, or clearing connection history in the client's...

Flexense Disk Sorter Enterprise security vulnerabilities

Flexense Disk Sorter Enterprise is a file management and disk space analysis software developed by Flexense Corporation. Version 13.6.12 of Flexense Disk Sorter Enterprise contains a security vulnerability. This vulnerability stems from the use of service paths without quotes in Windows service...

NETGATE Spy Emergency security vulnerability

NETGATE Spy Emergency is a Trojan virus detection and removal software developed by the Slovak company NETGATE. Version 25.0.650 of NETGATE Spy Emergency contains a security vulnerability. This vulnerability stems from the use of service paths without quotes in Windows service configurations, whi...

Weird Solutions DHCP Broadband Code Issues and Vulnerabilities

Weird Solutions DHCP Broadband is an IP address management software developed by Weird Solutions Corporation. Version 4.1.0.1503 of Weird Solutions DHCP Broadband contains a code vulnerability caused by service configurations that include service paths without quotes, which may lead to privilege...

MiracleLinux 4 : zsh-4.3.11-8.AXS4 (AXSA:2018-3183:01)

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2018-3183:01 advisory. zsh: Stack-based buffer overflow in genmatchesfiles at compctl.c CVE-2018-1083 zsh: buffer overflow when scanning very long directory paths for...

Acer ePowerSvc code issue vulnerability

Acer ePowerSvc is a power management backend service provided by Acer, a company based in Taiwan, China. Version 6.0.3008.0 of Acer ePowerSvc contains a code vulnerability. This vulnerability stems from service configuration paths that lack quotes, which may lead to privilege escalation...

BootPlus code issues and vulnerabilities

BootPlus is a permission management framework developed by JoeyBling. The BOOTP Turbo 2.0.0.1253 version has code vulnerabilities; these vulnerabilities stem from service path configurations in Windows services that lack quotation marks, potentially allowing arbitrary code to be executed...

Flexense DiskPulse Enterprise security vulnerabilities

Flexense DiskPulse Enterprise is a centralized report database server offered by Flexense DiskPulse Corporation. Version 13.6.14 of Flexense DiskPulse Enterprise contains a security vulnerability. This vulnerability stems from the use of service paths without quotes in Windows service...

Flexense Dup Scout security vulnerabilities

Flexense Dup Scout is a file cleanup tool developed by Flexense Corporation. Version 13.5.28 of Flexense Dup Scout contains a security vulnerability. This vulnerability stems from the Windows service configuration, where service paths are defined without quotes, potentially allowing for the...

Macro Expert code issue vulnerabilities

Macro Expert is a robotics process automation software developed by Macro Expert Corporation. Version 4.7 of Macro Expert contains a code vulnerability; this vulnerability stems from service paths that are not enclosed in quotes, which may allow for the execution of arbitrary code...

PT-2026-3329

Name of the Vulnerable Software and Affected Versions node-tar versions = 7.5.2 Description The node-tar library fails to sanitize the linkpath of Link hardlink and SymbolicLink entries when preservePaths is false, which is the default secure behavior. This allows malicious archives to bypass...

Flexense Disk Savvy code-related vulnerabilities

Flexense Disk Savvy is a hard drive space analysis tool developed by Flexense Corporation. Version 13.6.14 of Flexense Disk Savvy contains a code vulnerability. This vulnerability stems from Windows service configurations that include service paths without quotes, which may allow for the executio...

TotalAV security vulnerability

TotalAV is a set of computer security software developed by Total Corporation, supporting multiple platforms. This software includes features such as virus protection, anti-phishing, and anti-spyware. Version 5.15.69 of TotalAV contains a security vulnerability. This vulnerability stems from the...

CVE-2021-47791 SmartFTP Client 10.0.2909.0 - 'Multiple' Denial of Service

SmartFTP Client 10.0.2909.0 contains multiple denial of service vulnerabilities that allow attackers to crash the application through specific input manipulation. Attackers can trigger crashes by entering malformed paths, using invalid IP addresses, or clearing connection history in the client's...