Directory Traversal

Overview github.com/grafana/grafana/pkg/api/pluginproxy is an open-source platform for monitoring and observability. Affected versions of this package are vulnerable to Directory Traversal. An attacker can gain unauthorized read-only access to sensitive endpoints by appending an extra slash to th...

PT-2025-17446 · Unknown · Mojoportal

Name of the Vulnerable Software and Affected Versions: mojoPortal versions 2.9.0.1 and earlier Description: The issue allows an attacker to perform a Directory Traversal attack via the BetterImageGallery API Controller, specifically through the ImageHandler action. This can lead to unauthorized...

CVE-2025-43928

The CVE-2025-43928 entry concerns Infodraw Media Relay Service (MRS) v7.1.0.0. The MRS web server (port 12654) exposes a path traversal in the username field, enabling reading arbitrary files. Reading ServerParameters.xml could disclose administrator credentials (cleartext or MD5 hashed). Affecte...

CVE-2025-31497

TEIGarage is a webservice and RESTful service to transform, convert and validate various formats, focussing on the TEI format. The Document Conversion Service contains a critical XML External Entity XXE Injection vulnerability in its document conversion functionality. The service processes XML...

Security Bulletin: IBM Engineering Lifecycle Optimization - Publishing could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted

Summary Software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a...

PT-2025-16317 · Unknown · Notfound Coming Soon

Name of the Vulnerable Software and Affected Versions: NotFound Coming Soon, Maintenance Mode versions n/a through 1.1.1 Description: The issue is related to Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This...

Authorization Bypass Through User-Controlled Key

Overview DotNetNuke.Core is a references provider to the DotNetNuke.dll to develop extensions for the DNN Platform. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key that allows an attacker to enumerate sensitive files by manipulating request...

Important: tomcat9

Issue Overview: Path Equivalence: 'file.Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from...

Exploit for Path Traversal in Splunk

CVE-2024-36991-Tool This binary POC autom...

Exploit for Path Traversal in Splunk

Splunk Path Traversal Exploit CVE-2024-36991 Descript...

PT-2025-13145

Name of the Vulnerable Software and Affected Versions WpEvently versions n/a through 4.2.9 Description The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal', which allows PHP Local File Inclusion. This enables potential access to...

Access control error vulnerability exists in Vite (CNVD-2025-05817)

Vite is Vite open source a new front-end building tools . Vite has an access control error vulnerability that can be exploited by an attacker to bypass the development server's protection mechanism and illegally access sensitive files outside the project root directory...

AgentScope path traversal vulnerability

A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling t...

Directory Traversal

Overview InvokeAI is an An implementation of Stable Diffusion which provides various new features and options to aid the image generation process Affected versions of this package are vulnerable to Directory Traversal through the web API POST /api/v1/images/delete. An attacker can delete arbitrar...

CVE-2024-11042

In invoke-ai/invokeai version v5.0.2, the web API POST /api/v1/images/delete is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server, potentially including critical or sensitive system files such as SSH keys, SQLite...

CVE-2024-10948 Arbitrary File Read via Upload Function in binary-husky/gpt_academic

A vulnerability in the upload function of binary-husky/gptacademic allows any user to read arbitrary files on the system, including sensitive files such as config.py. This issue affects the latest version of the product. An attacker can exploit this vulnerability by intercepting the websocket...

CVE-2024-10948 Arbitrary File Read via Upload Function in binary-husky/gpt_academic

A vulnerability in the upload function of binary-husky/gptacademic allows any user to read arbitrary files on the system, including sensitive files such as config.py. This issue affects the latest version of the product. An attacker can exploit this vulnerability by intercepting the websocket...

CVE-2024-12390 Remote Code Execution in binary-husky/gpt_academic

A vulnerability in binary-husky/gptacademic version git 310122f allows for remote code execution. The application supports the extraction of user-provided RAR files without proper validation. The Python rarfile module, which supports symlinks, can be exploited to perform arbitrary file writes. Th...

CVE-2024-11042 Arbitrary File Delete in invoke-ai/invokeai

In invoke-ai/invokeai version v5.0.2, the web API POST /api/v1/images/delete is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server, potentially including critical or sensitive system files such as SSH keys, SQLite...

PT-2025-12235

Name of the Vulnerable Software and Affected Versions modelscope/agentscope versions all Description The issue is related to a path traversal problem in the application. It is present in the "/delete-workflow" endpoint, which allows an attacker to delete arbitrary files from the filesystem. This...