CVE-2021-29447

WordPress XXE 脆弱性 : CVE-2021-29447 悪意のあるWAVEファイル（例：作成者）をアップロードできるユーザーは、WordPressのメディアライブラリでXML解析の問題を悪用し、XXE攻撃を引き起こす可能性があり、ファイルシステムの開示につながる可能性があります。 脆弱なコード XML External Entity XXE 脆弱性 XMLでは、ドキュメント全体で再利用可能なカスタムエンティティを定義できます。これは、例えば重複を避けるために使用できます。 以下のコードは、後で使用するためにエンティティ myEntity を定義しています。...

Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability

A vulnerability in the Open Client Interface OCI XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution...

EUVD-2026-50336

Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox 2.20.2...

CVE-2026-66489 Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox 2.20.2...

CVE-2026-66489

Technical details about CVE-2026-66489 are not publicly available in the provided documents. Monitor for updates from vendors and security feeds to obtain affected versions, impact, and remediation once disclosed.

CVE-2026-53422

A flaw was found in Erlang OTP's Secure Shell SSH component, specifically within the SSH File Transfer Protocol SFTP daemon's sshsftpd module. An authenticated SFTP user can exploit an observable response discrepancy in the REALPATH handler to enumerate the existence of files and directories...

CVE-2025-43024

CVE-2025-43024 relates to HP ThinPro 8.1 SP8 and involves a GUI dialog that allows unauthorized viewing of files on the file system. The root cause is an insufficient access check in the dialog that displays file-system contents, enabling information disclosure. Public details across connected so...

CVE-2025-11371

CVE-2025-11371 is an unauthenticated Local File Inclusion (LFI) exists in Gladinet CentreStack and TrioFox. Connected documents describe an LFI affecting CentreStack/TrioFox via the default installation, enabling reading of server files through the /storage/t.dn endpoint by abusing an unsafely sa...

EUVD-2019-13658

Malware in sbrugna...

EUVD-2022-45547

Malicious code in bioql PyPI...

EUVD-2023-29227

Malicious code in bioql PyPI...

EUVD-2023-47488

Malicious code in bioql PyPI...

CVE-2025-3981

The CVE-2025-3981 entry concerns wowjoy Zhejiang HuZhou Huazhuo Information Technology Co., Ltd. Internet Doctor Workstation System v1.0. The vulnerability is tied to improper authorization in the endpoint /v1/prescription/details/, potentially allowing remote, unauthenticated access to processin...

CVE-2023-43067

Dell Unity prior to 5.3 contains an XML External Entity injection vulnerability. An XXE attack could potentially exploit this vulnerability disclosing local files in the file system...

CVE-2022-42477

An improper input validation vulnerability CWE-20 in FortiAnalyzer version 7.2.1 and below, version 7.0.6 and below, 6.4 all versions may allow an authenticated attacker to disclose file system information via custom dataset SQL queries...

Input validation

An improper input validation vulnerability CWE-20 in FortiAnalyzer version 7.2.1 and below, version 7.0.6 and below, 6.4 all versions may allow an authenticated attacker to disclose file system information via custom dataset SQL queries...

CVE-2022-42477

An improper input validation vulnerability CWE-20 in FortiAnalyzer version 7.2.1 and below, version 7.0.6 and below, 6.4 all versions may allow an authenticated attacker to disclose file system information via custom dataset SQL queries...

CVE-2021-33662

Under certain conditions, the installation of SAP Business One, version - 10.0, discloses sensitive information on the file system allowing an attacker to access information which would otherwise be restricted...

Microsoft Windows Device Management Enrollment Service Directory Junction Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

CVE-2020-12777 Combodo iTop - Broken Access Control

A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information...