CVE-2026-0604

CVE-2026-0604 affects the WordPress plugin FastDup – Fastest WordPress Migration & Duplicator via a Path Traversal flaw in the REST endpoint njt-fastdup/v1/template/directory-tree. An authenticated attacker with at least Contributor+ privileges can read contents of arbitrary server directories th...

CVE-2026-0604: Improper Limitation of a Pathname to a Restricted Directory

The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.7 via the 'dirpath' parameter in the 'njt-fastdup/v1/template/directory-tree' REST API endpoint. This makes it possible for authenticated attackers,...

CVE-2023-1043

A vulnerability was found in MuYuCMS 2.2. It has been classified as problematic. Affected is an unknown function of the file /editor/index.php. The manipulation of the argument dirpath leads to relative path traversal. It is possible to launch the attack remotely. The exploit has been disclosed t...

MuYuCMS 路径遍历漏洞

MuYuCMS is MuYuCMS open source a lightweight open source content management system . MuYuCMS 2.2 version of a security vulnerability , the vulnerability stems from the wrong operation of the parameter dirpath leads to relative path traversal...

CVE-2023-1043: Relative Path Traversal

A vulnerability was found in MuYuCMS 2.2. It has been classified as problematic. Affected is an unknown function of the file /editor/index.php. The manipulation of the argument dirpath leads to relative path traversal. It is possible to launch the attack remotely. The exploit has been disclosed t...

CVE-2006-4889: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Telekorn SignKorn Guestbook SL 1.3 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the dirpath parameter in 1 index.php, 2 includes/functions.gb.php, 3 includes/functions.admin.ph...

CVE-2006-4788: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/log.inc.php in Telekorn SignKorn Guestbook SL 1.3 and earlier, when registerglobals is enabled and SESSIONpermission parameter is set to "yes", allows remote attackers to execute arbitrary PHP code via a URL in the dirpath parameter...

CVE-2006-4670: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in PhotoKorn Gallery 1.52 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the dirpath parameter in 1 includes/cart.inc.php or 2 extras/extcats.php...