PT-2025-32402 · Unknown · Webpagetest

Name of the Vulnerable Software and Affected Versions: WebPageTest versions prior to 2.7 Description: WebPageTest versions 2.6 and earlier contain an arbitrary file upload flaw in the resultimage.php script. The application does not validate or sanitize user-supplied input before saving uploaded...

CVE-2019-17199

www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal for reading arbitrary files because of an unanchored regular expression, as demonstrated by the a.jpg\.. substring...

CVE-2019-12161

WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses such as 0300.0250 as a replacement for 192.168...

WebPageTest Directory Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WebPageTest Directory Traversal', 'Description' = %q This module exploits a directory traversal vulnerability found in WebPageTest. Due to the wa...

Performance-testing the Google I/O site

I've been looking at the performance of F1 websites recently, but before I dig into the last couple of teams, I figured I'd look a little closer to home, and dig into the Google I/O website. 1. Part 1: Methodology & Alpha Tauri 2. Part 2: Alfa Romeo 3. Part 3: Red Bull 4. Part 4: Williams 5. Part...

Who has the fastest F1 website in 2021? Part 7

This is part 7 in a multi-part series looking at the loading performance of F1 websites. Not interested in F1? It shouldn't matter. This is just a performance review of 10 recently-built/updated sites that have broadly the same goal, but are built by different teams, and have different performanc...

CVE-2019-17199

www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal for reading arbitrary files because of an unanchored regular expression, as demonstrated by the a.jpg.. substring...

CVE-2019-17199

www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal for reading arbitrary files because of an unanchored regular expression, as demonstrated by the a.jpg.. substring...

Directory traversal

www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal for reading arbitrary files because of an unanchored regular expression, as demonstrated by the a.jpg.. substring...

CVE-2019-17199

CVE-2019-17199 affects WPO WebPageTest 19.04 on Windows via www/getfile.php, where an unanchored regular expression permits Directory Traversal (reading arbitrary files), as demonstrated by the a.jpg.. substring. The issue is triggered in the vulnerable file/component (getfile.php) and weaponizes...

CVE-2019-17199

www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal for reading arbitrary files because of an unanchored regular expression, as demonstrated by the a.jpg.. substring...

CVE-2019-12161

WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses such as 0300.0250 as a replacement for 192.168...

CVE-2019-12161

WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses such as 0300.0250 as a replacement for 192.168...

Server side request forgery (ssrf)

WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses such as 0300.0250 as a replacement for 192.168...

CVE-2019-12161

WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses such as 0300.0250 as a replacement for 192.168...

CVE-2019-12161

CVE-2019-12161: The issue affects WPO WebPageTest 19.04 and is due to ValidateURL in www/runtest.php not handling octal-encoded IPs (e.g., 0300.0250 representing 192.168), enabling SSRF. The connected Red Hat and OSV/PRION entries corroborate the SSRF description and reference the same around 201...

Who has the fastest website in F1?

I was trying to make my predictions for the new Formula One season by studying the aerodynamics of the cars, their cornering speeds, their ability to run with different amounts of fuel. Then it hit me: I have no idea what I'm doing. So, I'm going to make my predictions the only way I know how: By...

CVE-2019-17199

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/webpagetesttraversal.rb 2025-10-23 21:12:58+00:00| seen| MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7...

CVE-2012-10049

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/webpagetestuploadexec.rb 2025-10-23 21:12:56+00:00| seen| MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7...

Cross site scripting

A Cross-Site Scripting XSS issue was discovered in webpagetest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data video passed to the webpagetest-master/www/speedindex/index.php URL. An attacker could execute arbitrary HTML and script code in a browser in the conte...