PT-2026-20526

Centova Cast 3.2.11 contains a file download vulnerability that allows authenticated attackers to retrieve arbitrary system files through the server.copyfile API endpoint. Attackers can exploit the vulnerability by supplying crafted parameters to download sensitive files like /etc/passwd using cu...

EUVD-2025-204689

Enterprise Cloud Database developed by Ragic has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files...

EUVD-2023-52435

Malicious code in bioql PyPI...

EUVD-2022-41586

Malicious code in bioql PyPI...

EUVD-2023-52441

Malicious code in bioql PyPI...

CVE-2025-9639

The QbiCRMGateway developed by Ai3 has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files...

CVE-2025-9257

WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files...

CVE-2025-8909 WellChoose｜Organization Portal System - Arbitrary File Reading through Path Traversal

Organization Portal System developed by WellChoose has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files...

CVE-2023-48378

Softnext Mail SQR Expert has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files...

CVE-2023-48373

ITPison OMICARD EDM has a path traversal vulnerability within its parameter “FileName” in a specific function. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files...

Path traversal

Smart eVision has a path traversal vulnerability in the Report API function due to insufficient filtering for special characters in URLs. A remote attacker with general user privilege can exploit this vulnerability to bypass authentication, access restricted paths and download system files...

WPZD-163(II) Distribution Grid Integration Measurement and Control Terminal has Logic Flaw Vulnerability

Xuji Group Co., Ltd. is a high-tech modern industrial group specializing in electric power, automation and intelligent manufacturing. WPZD-163II Power Distribution Grid Integration Measurement and Control Terminal suffers from a logic flaw vulnerability that can be exploited by attackers to...

CVE-2017-17108

Path traversal vulnerability in the administrative panel in KonaKart eCommerce Platform version 8.7 and earlier could allow an attacker to download system files, as well as upload specially crafted JSP files and in turn gain access to the server...

Franklin Fueling Systems TS-550 evo File Download Vulnerability

The Franklin Fueling Systems TS-550 evo is a fuel management system from Franklin Fueling Systems USA. The system monitors fuel storage and provides an intuitive and easy to recognize interface for alarm functions. A security vulnerability exists in the Franklin Fueling Systems TS-550 evo version...