CVE-2025-22712

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in QantumThemes Typify typify allows PHP Local File Inclusion.This issue affects Typify: from n/a through = 3.0.2...

CVE-2014-4941

Absolute path traversal vulnerability in Cross-RSS wp-cross-rss plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a full pathname in the rss parameter to proxy.php...

CVE-2014-4937

Directory traversal vulnerability in includes/bookxexport.php BookX plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

CVE-2005-1083

index.php in aeDating 3.2 allows remote attackers to include arbitrary files via the skin parameter...

CVE-2005-1571

Multiple directory traversal vulnerabilities in ShowOff! 1.5.4 allow remote attackers to read arbitrary files via ".." sequences in arguments to the 1 ShowAlbum, 2 ShowVideo, or 3 ShowGraphic scripts...

CVE-2023-29380

Warpinator before 1.6.0 allows remote file deletion via directory traversal in topdirbasenames...

CVE-2023-50449

JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter...

CVE-2023-40747

Directory traversal vulnerability exists in A.K.I Software's PMailServer/PMailServer2 products' CGIs included in Internal Simple Webserver. If this vulnerability is exploited, a remote attacker may access arbitrary files outside DocumentRoot...

CVE-2018-9851

In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to read any file via a modified pathname in an Admin-Tpl request, as demonstrated by use of '|' instead of '/' as a directory separator, in conjunction with a ".." sequence...

CVE-2018-18485

An issue was discovered in PHPSHE 1.7. admin.php?mod=db=del allows remote attackers to delete arbitrary files via directory traversal sequences in the dbname parameter. This can be leveraged to reload the product by deleting install.lock...

CVE-2018-18778

ACME minihttpd before 1.30 lets remote users read arbitrary files...

CVE-2018-19612

The /uploadfile? functionality in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allows remote users to upload malicious file types and execute ASP code...

CVE-2009-4374

Directory traversal vulnerability in repository/repositoryattachment.php in AlienVault Open Source Security Information Management OSSIM 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to upload files into arbitrary directories via a .. dot dot in the iddocument paramet...

CVE-2009-4231

Directory traversal vulnerability in as/lib/plugins.php in SweetRice 0.5.3 and earlier allows remote attackers to include and execute arbitrary local files via .. dot dot in the plugin parameter...

CVE-2010-0676

Directory traversal vulnerability in index.php in the RWCards comrwcards component 3.0.18 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter...

CVE-2010-0537

DesktopServices in Apple Mac OS X 10.6 before 10.6.3 does not properly resolve pathnames in certain circumstances involving an application's save panel, which allows user-assisted remote attackers to trigger unintended remote file copying via a crafted share name...

CVE-2001-1510

Allaire JRun 2.3.3, 3.0 and 3.1 running on IIS 4.0 and 5.0, iPlanet, Apache, JRun web server JWS, and possibly other web servers allows remote attackers to read arbitrary files and directories by appending 1 "%3f.jsp", 2 "?.jsp" or 3 "?" to the requested URL...

CVE-2003-1313

Multiple PHP remote file inclusion vulnerabilities in EternalMart Mailing List Manager EMLM 1.32 allow remote attackers to execute arbitrary PHP code via a URL in 1 the emmladminpath parameter to admin/auth.php or 2 the emmlpath parameter to emmlemailfunc.php...

CVE-2003-1537

Directory traversal vulnerability in PostNuke 0.723 and earlier allows remote attackers to include arbitrary files named theme.php via the theme parameter to index.php...

CVE-2021-33564

An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verifyurl option is disabled. This may lead to code execution. The problem occurs because the generate and process features...