PYSEC-2026-3643 Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Summary Open WebUI lets a client define a model inline on a chat request instead of selecting a saved workspace model. The knowledge attached to such an inline model was used as-is, without checking that the caller can read what it points at. Any authenticated user who knows another user's file i...

EUVD-2018-0340

Malware in sbrugna...

EUVD-2020-11786

Malware in sbrugna...

EUVD-2018-0218

Malware in sbrugna...

EUVD-2018-0206

Malware in sbrugna...

CVE-2019-9060

An issue was discovered in CMS Made Simple 2.2.8. It is possible to achieve unauthenticated path traversal in the CGExtensions module in the file action.setdefaulttemplate.php with the m1filename parameter; and through the action.showmessage.php file, it is possible to read arbitrary file content...

CVE-2024-42499: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'Path Traversal' issue exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an attacker may be able to know whether a file exists at a specific path, and/or obtain some part of the file contents under specif...

PYSEC-2024-247

A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI path in the request to fetch arbitrary file content, bypassing intended access restrictions. The...

CVE-2018-12713

GIMP through 2.10.2 makes ggettmpdir calls to establish temporary filenames, which may result in a filename that already exists, as demonstrated by the gimpwriteandreadfile function in app/tests/test-xcf.c. This might be leveraged by attackers to overwrite files or read file content that was...

MetInfo latest version of the arbitrary file read vulnerability warning-the black bar safety net

An attacker by submitting a carefully constructed parameters can get the server end of any file content! MetInfo 5.2 which is the current latest version include/thumb.php file originally used to get the thumbnail, but its structure is the thumbnail path to the presence of an external controlled...

Caedo HTTPd Server 0.5.1 ALPHA - Arbitrary File Download

Caedo HTTPd Server 0.5.1 ALPHA - Arbitrary File Download !/usr/bin/perl use LWP::Simple; Caedo HTTPd Server v 0.5.1 ALPHA Remote File Download Exploit Author : Zer0 Thunder if @ARGV $file"; print FILE $result; close FILE; print " File Saved : $file \n\n"; print...

Simple PHP test-vulnerability warning-the black bar safety net

The test site is as follows http://www.. com Find a stepping on point http://www.. com/zhaobiao/zhaobiaohyshow. php? id=1 4 9 8 3 0 Submit a' Returns the result Warning: mysqlresult: supplied argument is not a valid MySQL result resource in /var/www/html/zhaobiao/zhaobiaohyshow.php on line 1 3 5...