32 matches found
CVE-2026-127050
Backup Migration before 2.1.8 for WordPress contains a path traversal vulnerability in its PclZip restore fallback that allows an attacker to achieve arbitrary file write when an administrator restores a malicious backup archive on a server lacking the PHP zip extension. Attackers can craft a zip...
CVE-2026-127050 Backup Migration before 2.1.8 Path Traversal via PclZip Restore Fallback
Backup Migration before 2.1.8 for WordPress contains a path traversal vulnerability in its PclZip restore fallback that allows an attacker to achieve arbitrary file write when an administrator restores a malicious backup archive on a server lacking the PHP zip extension. Attackers can craft a zip...
CVE-2026-127050
Backup Migration before 2.1.8 for WordPress is vulnerable to a path traversal vulnerability within its PclZip restore fallback . This issue occurs on servers lacking the PHP zip extension; when an administrator restores a malicious backup archive, the PclZip extract() function processes entry nam...
EUVD-2026-124371
Backup Migration before 2.1.8 for WordPress contains a path traversal vulnerability in its PclZip restore fallback that allows an attacker to achieve arbitrary file write when an administrator restores a malicious backup archive on a server lacking the PHP zip extension. Attackers can craft a zip...
CVE-2026-104081
KodExplorer versions prior to 4.55 are vulnerable to a path traversal vulnerability located in the unzip_pre_name() function within app/function/helper.function.php. The root cause is a non-recursive str_replace() sanitization pass that can be bypassed using crafted filenames like ....//, combine...
CVE-2026-104081
KodExplorer before 4.55 contains a path traversal vulnerability in the unzipprename function within app/function/helper.function.php, where a single non-recursive strreplace sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract call in...
CVE-2026-104081: Improper Limitation of a Pathname to a Restricted Directory
KodExplorer before 4.55 contains a path traversal vulnerability in the unzipprename function within app/function/helper.function.php, where a single non-recursive strreplace sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract call in...
PT-2026-108919
KodExplorer before 4.55 contains a path traversal vulnerability in the unzip pre name function within app/function/helper.function.php, where a single non-recursive str replace sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract call in...
CVE-2026-86828 BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback
The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code...
CVE-2026-86828 BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback
The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code...
CVE-2026-86828
The BackWPup WordPress plugin (versions prior to 5.7.7 ) is vulnerable to a path traversal flaw during the backup restore process. When the plugin's fallback archive library is utilized, it fails to properly restrict the destination path of extracted files. This allows high-privileged users to wr...
Linux Distros Unpatched Vulnerability : CVE-2017-14719
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components. CVE-2017-14719...
FreeBSD : wordpress -- multiple issues (a48d4478-e23f-4085-8ae4-6b3a7b6f016b)
wordpress developers report : Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL. Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name. Before...
WordPress ZipArchive and PclZip Component Directory Traversal Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports in PHP and MySQL servers to set up a personal blog site . ZipArchive and PclZip components are among the compression/decompression components . A directory traversal...
CVE-2017-14719
Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components...
DEBIAN-CVE-2017-14719
Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components...
CVE-2017-14719
Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components...
UBUNTU-CVE-2017-14719
Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components...
