14559 matches found
CVE-1999-0487
The DHTML Edit ActiveX control in Internet Explorer allows remote attackers to read arbitrary files...
CVE-2025-27566
Path traversal vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and versions prior to Ver. 3.0.47. This is an issue with insufficient path validation in the backup feature, and exploitation requires the administrator privilege. If this vulnerability is exploited, a remote...
Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Tomcat vulnerability (USN-7525-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7525-1 advisory. It was discovered that Apache Tomcat incorrectly implemented partial PUT functionality by replacing path separators with dots ...
HYPR Passwordless ๅฎๅ จๆผๆด
HYPR Passwordless is an identity security solution from HYPR. A security vulnerability exists in HYPR Passwordless versions prior to 10.1, which stems from improper link resolution prior to file access and could lead to elevation of privilege...
PT-2025-22446 ยท Unknown ยท Campcodes Online Shopping Portal
Name of the Vulnerable Software and Affected Versions: Campcodes Online Shopping Portal version 1.0 Description: A critical vulnerability has been found in Campcodes Online Shopping Portal. This affects an unknown part of the file /admin/edit-subcategory.php. The manipulation of the productimage1...
Adobe ColdFusion Path Traversal Vulnerability (CNVD-2025-10673)
Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion suffers from a path traversal vulnerability that originates from an improperly...
PT-2025-22391
Name of the Vulnerable Software and Affected Versions reint downloadmanager extension versions prior to 5.0.1 Description The issue allows Insecure Direct Object Reference, enabling remote attackers to read arbitrary files via the downloaduid parameter in the "downloadAction". Recommendations For...
PT-2025-22317 ยท Unknown ยท Project Worlds Online Time Table Generator
Name of the Vulnerable Software and Affected Versions: ProjectWorlds Online Time Table Generator version 1.0 Description: A critical issue was found in the ProjectWorlds Online Time Table Generator. The problem is related to the file /admin/add teacher.php, where the manipulation of the e argumen...
PT-2025-22374
Name of the Vulnerable Software and Affected Versions sr feuser register extension for TYPO3 versions through 12.4.8 Description The issue allows for Insecure Direct Object Reference, enabling attackers to read arbitrary files. This could potentially lead to unauthorized access to sensitive...
PT-2025-22134 ยท NetGear ยท Netgear Dgnd3700
Name of the Vulnerable Software and Affected Versions: Netgear DGND3700 version 1.1.00.15 1.00.15NA Description: A vulnerability has been found in the Netgear DGND3700, affecting some unknown functionality of the file /BRS top.html. The manipulation leads to information disclosure. The attack may...
CVE-2025-27566
Path traversal vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and versions prior to Ver. 3.0.47. This is an issue with insufficient path validation in the backup feature, and exploitation requires the administrator privilege. If this vulnerability is exploited, a remote...
๐ ABB Cylon FLXeon 9.3.5 siteGuide.js Authenticated Directory Traversal
The ABB Cylon FLXeon BACnet controller is vulnerable to authenticated file traversal via the /api/siteGuide endpoint. An attacker with valid credentials can manipulate the filename parameter to move and access or overwrite arbitrary files. The issue arises due to improper input validation in...
PT-2025-21943 ยท Unknown ยท Sourcecodester Stock Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Stock Management System version 1.0 Description: A critical issue affects the processing of the file /php action/changePassword.php, where the manipulation of the user id argument leads to SQL injection. The attack can be...
PT-2025-21882 ยท Sourcecodester ยท Sourcecodester Student Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Student Result Management System version 1.0 Description: A critical issue has been found in the Image File Handler component of the affected system, specifically in the file /admin/core/update student.php. The manipulation of...
PT-2025-21938 ยท Unknown ยท Project Worlds Online Lawyer Management System
Name of the Vulnerable Software and Affected Versions: Projectworlds Online Lawyer Management System version 1.0 Description: A critical issue has been found in the system, affecting some unknown functionality of the file /lawyer registation.php. The manipulation of the email argument leads to SQ...
The vulnerability in the set of VMware Tools relates to incorrect definition of the link before accessing the file, allowing an attacker to escalate their privileges.
The vulnerability of the VMware Tools utility is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow an attacker to increase their privileges...
ABB Cylon FLXeon 9.3.5 (siteGuide.js) Authenticated Directory Traversal
Summary BACnetยฎ Smart Building Controllers. ABB's BACnet portfolio features a series of BACnetยฎ IP and BACnet MS/TP field controllers for ASPECTยฎ and INTEGRAโข building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boiler...
๐ ABB Cylon FLXeon 9.3.5 capture.js Authenticated File Disclosure / Deletion
The ABB Cylon FLXeon BACnet controller is vulnerable to a path traversal flaw in its capture.js endpoint due to unsanitized user input being directly concatenated into a filesystem path. An attacker can exploit this by supplying crafted file names to access arbitrary files outside the intended va...
Srimax Output Messenger Directory Traversal Vulnerability
Srimax Output Messenger contains a directory traversal vulnerability that allows an attacker to access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access...
CVE-2025-40629
PNETLab 4.2.10 does not properly sanitize user inputs in its file access mechanisms. This allows attackers to perform directory traversal by manipulating file paths in HTTP requests. Specifically, the application is vulnerable to requests that access sensitive files outside the intended directory...