CVE-2023-28669

Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control input files for the 'Record JaCoCo coverage report' post-build action...

CVE-2022-30007

GXCMS V1.5 has a file upload vulnerability in the background. The vulnerability is the template management page. You can edit any template content and then rename to PHP suffix file, after calling PHP file can control the server...

CVE-2022-45918

ILIAS before 7.16 allows External Control of File Name or Path...

CVE-2021-32754

FlowDroid is a data flow analysis tool. FlowDroid versions prior to 2.9.0 contained an XML external entity XXE vulnerability that allowed an attacker who had control over the source/sink definition file in XML format to read files from external locations. In order for this to occur, the XML-based...

CVE-2021-28646

An insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to take control of a specific log file on affected installations...

CVE-2020-12463

An elevation of privilege vulnerability exists in Avira Software Updater before 2.0.6.27476 due to improperly handling file hard links. This allows local users to obtain take control of arbitrary files...

CVE-2020-26506

An Authorization Bypass vulnerability in the Marmind web application with version 4.1.141.0 allows users with lower privileges to gain control to files uploaded by administrative users. The accessed files were not visible by the low privileged users in the web GUI...

CVE-2025-47508 WordPress GamiPress <= 7.3.7 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Ruben Garcia GamiPress allows PHP Local File Inclusion. This issue affects GamiPress: from n/a through 7.3.7...

PT-2025-16996 · Földesi · Széchenyi 2020 Logo

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Földesi, Mihály Széchenyi 2020 Logo allows PHP Local File Inclusion. This issue affects Széchenyi 2020 Logo: from n/a through 1.1...

WordPress plugin WP Travel Engine 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

Jenkins AnchorChain Plugin Has a Cross-Site Scripting (XSS) Vulnerability

Jenkins AnchorChain Plugin 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the javascript: scheme. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control the input file for the Anchor Chain post-build step...

CVE-2025-30196

The Jenkins AnchorChain Plugin 1.0 is vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is the lack of validation for URL schemes when the plugin generates links based on workspace content, specifically allowing the javascript: scheme. Attackers who can control the i...

CVE-2025-24996

CVE-2025-24996 : Affects Windows NTLM. External control of a file name or path enables an unauthorized network spoofing scenario, potentially allowing impersonation over a network. CVSSv3.1 base 6.5 (Network attack, low complexity, no privileges required, user interaction required; CIA: high conf...

External Control of File Name or Path

Overview io.pebbletemplates:pebble is a java templating engine inspired by Twig. Affected versions of this package are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates...

CVE-2024-38657

External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to write arbitrary files...

CVE-2024-38657

CVE-2024-38657 affects Ivanti Connect Secure not newer than 22.7R2.4 and Ivanti Policy Secure not newer than 22.7R1.3. A remote authenticated attacker with admin privileges can write arbitrary files via external control of a file name. Remediation: update to supported fixed versions (ICS 22.7R2.4...

CVE-2024-12058

External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to read arbitrary files...

CVE-2024-12058

External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to read arbitrary files...

PT-2025-1074

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Expedition affected versions not specified Description The issue is related to an arbitrary file deletion vulnerability in Palo Alto Networks Expedition. This vulnerability allows an unauthenticated attacker to delete...

ZOO-Project 代码问题漏洞

ZOO-Project is an open source processing platform from ZOO-Project Open Source. A code issue vulnerability exists in ZOO-Project that stems from not performing input validation and a path traversal vulnerability that allows an attacker to take full control of the files returned in a response...