CVE-2025-36174

IBM Integrated Analytics System 1.0.0.0 through 1.0.30.0 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened...

CVE-2010-20120

Maple versions up to and including 13's Maplet framework allows embedded commands to be executed automatically when a .maplet file is opened. This behavior bypasses standard security restrictions that normally prevent code execution in regular Maple worksheets. The vulnerability enables attackers...

CVE-2010-20120 Maple <= v13 Maplet File Creation and Command Execution

Maple versions up to and including 13's Maplet framework allows embedded commands to be executed automatically when a .maplet file is opened. This behavior bypasses standard security restrictions that normally prevent code execution in regular Maple worksheets. The vulnerability enables attackers...

GHSA-V22V-XWH7-2VRM UnoPim vulnerable to remote code execution through Arbitrary File upload

Summary: Affected Functionality: Image upload at User creation Endpoint: /admin/settings/users/create Details The image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy lik...

WordPress plugin StoreKeeper for WooCommerce 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

Linux Distros Unpatched Vulnerability : CVE-2020-15692

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be open...

CVE-2025-7650

The CVE-2025-7650 entry concerns the BizCalendar Web WordPress plugin (versions up to 1.1.0.50) and describes an Authenticated (Contributor+) Local File Inclusion via the bizcalv shortcode. The underlying risk is that an authenticated attacker with Contributor-level access can include and execute...

CVE-2023-43687

An issue was discovered in Malwarebytes before 4.6.14.326 and before 5.1.5.116 and Nebula 2020-10-21 and later. There is a Race condition that leads to code execution because of a lack of locks between file verification and execution...

Seagate Toolkit 安全漏洞

Seagate Toolkit is a software for managing and backing up data from Seagate USA. A security vulnerability exists in Seagate Toolkit versions prior to 2.34.0.33, which originates from an un-referenced search path or element and could result in the execution of a malicious file...

The vulnerability of the cloud integrated development environment (IDE) Atheos relates to an incorrect restriction on the path to the restricted access directory. This allows a perpetrator to execute arbitrary files on the server.

The vulnerability of the cloud integrated development environment IDE Atheos is related to an incorrect restriction on the path name to the restricted access directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary files on the server remotely...

CVE-2015-10133

The Subscribe to Comments for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.1.2 via the Path to header value. This allows authenticated attackers, with administrative privileges and above, to include and execute arbitrary files on the server, allowing the...

PT-2025-28338 · WordPress · Woodmart

Name of the Vulnerable Software and Affected Versions: WoodMart plugin for WordPress versions up to, and including, 8.2.3 Description: The issue allows authenticated attackers with Contributor-level access and above to include and execute arbitrary .php files on the server via the layout attribut...

PT-2025-27586 · WordPress · The Ads Pro Plugin

Name of the Vulnerable Software and Affected Versions: The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager versions up to, and including, 4.89 Description: The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the bsa template parameter o...

CVE-2025-52562 Convey Panel Directory Traversal in LocaleController leading to Remote Code Execution

Convoy is a KVM server management panel for hosting businesses. In versions 3.9.0-rc3 to before 4.4.1, there is a directory traversal vulnerability in the LocaleController component of Performave Convoy. An unauthenticated remote attacker can exploit this vulnerability by sending a specially...

PT-2025-26645 · Convoy · Convoy

Name of the Vulnerable Software and Affected Versions: Convoy versions 3.9.0-rc3 through 4.4.0 Description: Convoy is a KVM server management panel for hosting businesses. A directory traversal vulnerability exists in the LocaleController component, allowing an unauthenticated remote attacker to...

Path Traversal

Liferay is vulnerable to path traversal. The vulnerability is due to improper validation of the comliferayserveradminwebportletServerAdminPortletjarName parameter, which allows remote attackers to add or execute arbitrary files...

CVE-2025-3594

CVE-2025-3594 is a path traversal vulnerability in Liferay Portal 7.0.0–7.4.3.4 and Liferay DXP 7.4 GA, 7.3 GA through update 34, plus older unsupported versions. It allows remote attackers to add files to arbitrary server locations and to download/execute arbitrary files from the download server...

PT-2025-25557 · Liferay +1 · Liferay Portal +2

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.0.0 through 7.4.3.4 Liferay DXP versions 7.4 GA, 7.3 GA through update 34 Description: A path traversal vulnerability exists with the downloading and installation of Xuggler, allowing remote attackers to add files to...

CVE-2025-4200

The Zagg - Electronics & Accessories WooCommerce WordPress Theme theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.1 via the loadview function that is called via at least three AJAX actions: 'loadmorepost', 'loadshop', and 'loadmoreproduct. This...

CVE-2025-4200 Zagg - Electronics & Accessories WooCommerce WordPress Theme <= 1.4.1 - Unauthenticated Local File Inclusion

The Zagg - Electronics & Accessories WooCommerce WordPress Theme theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.1 via the loadview function that is called via at least three AJAX actions: 'loadmorepost', 'loadshop', and 'loadmoreproduct. This...