CVE-2025-34181 NetSupport Manager < 14.12.0001 Authenticated Path Traversal Arbitrary File Write RCE

NetSupport Manager 14.12.0001 contains an arbitrary file write vulnerability in its Connectivity Server/Gateway PUTFILE request handler. An attacker with a valid Gateway Key can supply a crafted filename containing directory traversal sequences to write files to arbitrary locations on the server...

NetSupport Manager 安全漏洞

NetSupport Manager is a remote control software from NetSupport Manager, Inc. A security vulnerability exists in NetSupport Manager versions prior to 14.12.0001 that stems from the presence of an arbitrary file write in the Connectivity Server/Gateway PUTFILE request handler, which could lead to...

PT-2025-51233

NetSupport Manager 14.12.0001 contains an arbitrary file write vulnerability in its Connectivity Server/Gateway PUTFILE request handler. An attacker with a valid Gateway Key can supply a crafted filename containing directory traversal sequences to write files to arbitrary locations on the server...

Adobe ColdFusion Improper Input Validation Vulnerability

Adobe ColdFusion is a dynamic Web server platform and application development framework maintained by Adobe for rapidly building and deploying data-driven dynamic Web sites, Web applications, and enterprise-class services. An improper input validation vulnerability exists in Adobe ColdFusion, whi...

Arbitrary File Write

fontTools is vulnerable to an arbitrary file write. The vulnerability is due to improper handling of malicious .designspace files in the fontTools.varLib module, which allows an attacker to achieve remote code execution by writing arbitrary files when processed...

Directory Traversal

Dosage is vulnerable to Directory Traversal. The vulnerability is due to improper handling of file extensions derived from the HTTP Content-Type header, which allows an attacker to write arbitrary files outside the intended directory...

CVE-2025-12655

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint /wp-json/hippoo/v1/wc/token/savecallback/tokenid being registered with...

Directory Traversal

alexusmai/laravel-file-manager is vulnerable to Directory Traversal. The vulnerability is due to insufficient validation of extraction paths during archive unzip functionality, which allows an attacker to write files to arbitrary locations on the filesystem...

EUVD-2025-203094

Weaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip...

Exploit for Path Traversal in 7-Zip

7-ZiProwler CVE-2025-11001 Overview Result of my qu...

Security Bulletin: Vulnerabilities in brace-expansion, tmp, urllib3, pycryptodomex and cross-site request forgery might affect IBM Storage Defender Sentinel Anomaly Scan Engine.

Summary IBM Storage Defender Sentinel Anomaly Scan Engine can be affected by vulnerabilities in brace-expansion, tmp, urllib3, pycryptodomex, and cross-site request forgery. Vulnerabilities include launching remote attacks, arbitrary file and directory writes, obtain sensitive information, disabl...

CVE-2025-12655

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint /wp-json/hippoo/v1/wc/token/savecallback/tokenid being registered with...

EUVD-2025-203057

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint /wp-json/hippoo/v1/wc/token/savecallback/tokenid being registered with...

CVE-2025-12655

CVE-2025-12655 corresponds to the Hippoo Mobile App for WooCommerce WordPress plugin. The initial records and a Wordfence post confirm a vulnerability in all versions up to 1.7.1 caused by a REST API endpoint (/wp-json/hippoo/v1/wc/token/save_callback/{token_id}) registered with a permissive perm...

CVE-2025-12655 Hippoo Mobile App for WooCommerce <= 1.7.1 - Missing Authorization to Unauthenticated Limited File Write

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint /wp-json/hippoo/v1/wc/token/savecallback/tokenid being registered with...

PT-2025-50957

Name of the Vulnerable Software and Affected Versions Weaviate OSS versions prior to 1.33.4 Description An attacker who can insert data into the database can create an entry name containing an absolute path for example, /etc/... or utilize parent directory traversal ../../.. to bypass the restore...

PT-2025-50890

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint /wp-json/hippoo/v1/wc/token/save callback/token id being registered with permission...

WordPress Hippoo Mobile App for WooCommerce plugin <= 1.7.1 - Missing Authorization to Unauthenticated Limited File Write vulnerability

Missing Authorization to Unauthenticated Limited File Write vulnerability discovered by NumeX in WordPress Plugin Hippoo Mobile App for WooCommerce versions = 1.7.1...

Arbitrary file write via tar traversal

Summary A crafted tar.gz passed to MLflow pyfunc extraction is unpacked with tarfile.extractall without path validation. Archive entries containing .. or absolute paths can escape the destination directory and write arbitrary files on the host. This is reachable when users supply prebuiltenvuri o...

CVE-2025-34392

Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload...