PT-2026-20527

Crystal Live HTTP Server 6.01 contains a directory traversal vulnerability that allows remote attackers to access system files by manipulating URL path segments. Attackers can use multiple '../' sequences to navigate outside the web root and retrieve sensitive configuration files like Windows...

CVE-2025-15541 Access to System Files via SFTP on TP-Link VX800v

Improper link resolution in the VX800v v1.0 SFTP service allows authenticated adjacent attackers to use crafted symbolic links to access system files, resulting in high confidentiality impact and limited integrity risk...

CVE-2021-47850

Mini Mouse 9.2.0 contains a path traversal vulnerability that allows remote attackers to access arbitrary system files and directories through crafted HTTP requests. Attackers can retrieve sensitive files like win.ini and list contents of system directories such as C:\Users\Public by manipulating...

CVE-1999-0238

php.cgi allows attackers to read any file on the system...

EUVD-2024-33222

Malicious code in bioql PyPI...

EUVD-2023-41195

Malicious code in bioql PyPI...

CVE-2022-41591

The backup module has a path traversal vulnerability. Successful exploitation of this vulnerability causes unauthorized access to other system files...

CVE-2019-7183

This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, QNAP recommend updating QTS to their latest versions...

CVE-2024-34521: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R10240, which allows an administrative user to access system files with the file permissions of the privileged system user running the application...

CVE-2023-37925: Improper Privilege Management

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50W series firmware versions 4.16 through 5.37, USG20W-VPN series firmware versions 4.16 through 5.37,...

CVE-2023-5960: Improper Privilege Management

An improper privilege management vulnerability in the hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.37 and VPN series firmware versions 4.30 through 5.37 could allow an authenticated local attacker to access the system files on an affected device...

CVE-2023-25396

Privilege escalation in the MSI repair functionality in Caphyon Advanced Installer 20.0 and below allows attackers to access and manipulate system files...

CVE-2022-20956: Incorrect Use of Privileged APIs

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to bypass authorization and access system files. This vulnerability is due to improper access control in the web-based management interface of an affected...

Johnson Controls Metasys 安全漏洞

Johnson Controls Metasys system is the United States Johnson Controls Johnson Controls company's set of building automation system. A security vulnerability exists in Johnson Controls Metasys version 11.0 and prior versions that can be exploited by an attacker to send specially crafted web messag...

Path traversal

The specific function in ASUS BMC’s firmware Web management page Record video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

ASUS BMC Firmware 路径遍历漏洞

ASUS BMC Firmware is a firmware from Asus China. The ASUS BMC Firmware suffers from a path traversal vulnerability that stems from the Record video file function not filtering specific parameters. A remote attacker could use this vulnerability to gain administrator privileges and then traverse...

PT-2021-17824

Name of the Vulnerable Software and Affected Versions: ASUS BMC affected versions not specified Description: The issue concerns a specific function in the ASUS BMC's firmware Web management page, namely the Get video file function, which fails to filter a specific parameter. This allows remote...

PT-2021-17825

Name of the Vulnerable Software and Affected Versions: ASUS BMC affected versions not specified Description: The issue concerns a function in the ASUS BMC's firmware Web management page, specifically the Delete video file function, which fails to filter a specific parameter. This allows remote...

VulnCheck KEV: CVE-2019-7194

QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files...

XML External Entity (XXE)

selenium-firefox-driver is vulnerable to XML external entity attacks. External DTD declarations are not disabled, allowing a remote attacker to perform server-side request forgery attacks, local port scanning, access system files and possibly a denial of service attack...