CVE-2025-0103

An SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. This vulnerability also enables attackers to create and read arbitrary files on...

CVE-2025-22152 Improper Path Validation Enables Path Traversal in Multiple Components in Atheos

Atheos is a self-hosted browser-based cloud IDE. Prior to v600, the $path and $target parameters are not properly validated across multiple components, allowing an attacker to read, modify, or execute arbitrary files on the server. These vulnerabilities can be exploited through various attack...

iocharger 安全漏洞

iocharger is an electric vehicle charging and smart energy management solution from Galaxy Zhangtan iocharger, a Chinese company. A security vulnerability exists in Iocharger. An attacker exploiting this vulnerability could delete arbitrary files...

The vulnerability of the interface of the Gogs self-managed Git repository creation software allows a hacker to write arbitrary files.

The vulnerability of the Gogs self-managed Git repository creation software interface is related to improper restrictions on the path name to the restricted-access directory. Exploiting this vulnerability allows a malicious actor, operating remotely, to write arbitrary files...

keras Path Traversal vulnerability

An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the getfile function...

PYSEC-2025-121

An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the getfile function...

PYSEC-2025-121

An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the getfile function...

CVE-2024-12853

The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 2.11.10. This makes it possible for authenticated attackers, with Author-level access and above, to uploa...

CVE-2024-55459

CVE-2024-55459 affects keras 3.7.0, allowing an attacker to write arbitrary files to a user’s machine by downloading a crafted tar via the get_file function. The connected IBM advisories corroborate that this vulnerability has been addressed in product-specific updates (e.g., upgrading impacted I...

PT-2025-1632

Name of the Vulnerable Software and Affected Versions WebinarPress plugin for WordPress versions up to, and including, 1.33.24 Description The WebinarPress plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the sync-import-imgs function and missing...

Mitel MiCollab Path Traversal Vulnerability

Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated,...

PT-2025-1964 · Wp Guru · Error Log Viewer By Wp Guru

Name of the Vulnerable Software and Affected Versions: Error Log Viewer By WP Guru plugin for WordPress versions up to, and including, 1.0.1.3 Description: The issue allows unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information, vi...

CVE-2024-13043

Panda Security Dome Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to execute low-privileged code on the target system in order to...

CVE-2024-12754

AnyDesk Link Following Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this...

The vulnerability of the command-line interface (CLI) of the PAN-OS operating system, allowing a hacker to read arbitrary files

The vulnerability of the command-line interface CLI of the PAN-OS operating system is related to the lack of measures taken to neutralize substitution characters or characters that match each other. Exploiting this vulnerability can allow an attacker to read arbitrary files...

The vulnerability of the corporate version of the GitHub Enterprise Server, related to incorrect restrictions on the path to the restricted catalog, allows attackers to gain read access to arbitrary files.

The vulnerability of the corporate version of the GitHub Enterprise Server is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain read access to arbitrary files by adding specially...

WordPress plugin Database Backup and check Tables Automated With Scheduler 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A path traversal vulnerability exists in...

PT-2024-17767 · WordPress · Database Backup/Check Tables Automated With Scheduler 2024

Name of the Vulnerable Software and Affected Versions: Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress versions up to, and including, 2.32 Description: The issue allows authenticated attackers with administrator-level access and above to read the contents of...

SUSE CVE-2024-12582

A flaw was found in the skupper console, a read-only interface that renders cluster network, traffic details, and metrics for a network application that a user sets up across a hybrid multi-cloud environment. When the default authentication method is used, a random password is generated for the...

The vulnerability of the DownloadFileServlet function in the software for monitoring, managing, and configuring VigorAP access points and VigorSwitches in the DrayTek VigorConnect local network allows a malicious actor to upload arbitrary files with root privileges.

The vulnerability of the DownloadFileServlet function in the software for monitoring, managing, and configuring VigorAP access points and VigorSwitches in the DrayTek VigorConnect local network is related to the unlimited download of dangerous types of files. Exploiting this vulnerability could...