711 matches found
CVE-2021-22986-Poc
CVE-2021-22986-Poc This is a Poc for BIGIP iControl unauth RCE POC : curl -ksu admin:redacted https://192.168.123.134/mgmt/tm/access/bundle-install-tasks -d '"filePath":"id"' | jq . curl -ksu : https://192.168.123.134/mgmt/shared/authn/login -d...
CVE-2021-42183
CVE-2021-42183 MasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/api/asset/image/. Detection If this file is readable it means the vulnerablilty exists. https://example.com/index.cfm/api/asset/image/?filePath=/Application.cfc Exploit...
CVE-2026-94044
A flaw was found in 03-lovepreetSingh MCP. A remote attacker could exploit a path traversal vulnerability by manipulating the filePath or content arguments when calling the createfile function. This could allow the attacker to access or modify arbitrary files on the system, potentially leading to...
CVE-2026-121453
SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other...
CVE-2026-121453 SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint
SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other...
CVE-2026-121453
SQLBot versions through 1.10.3 are vulnerable to a path traversal vulnerability in the importToDb endpoint. The root cause is an unsanitized filePath parameter , which allows authenticated workspace administrators to read files from the server or other workspaces. By supplying absolute paths or ....
CVE-2026-121453 SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint
SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other...
EUVD-2026-115885
SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other...
CVE-2026-121453 SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint
SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other...
CLEANSTART-2024-DW33743 Uncontrolled recursion in Glob in path/filepath before Go 1
Security vulnerability affects the go package. Uncontrolled recursion in Glob in path/filepath before Go 1...
CVE-2026-119557
n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers. Attackers can supply ../ sequences and query strings via webhook, chat, or...
EUVD-2026-113822
n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers. Attackers can supply ../ sequences and query strings via webhook, chat, or...
CVE-2026-119557 n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node
n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers. Attackers can supply ../ sequences and query strings via webhook, chat, or...
PT-2026-133495
n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers. Attackers can supply ../ sequences and query strings via webhook, chat, or...
CVE-2026-119557: n8n-io n8n: n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows…
n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers. Attackers can supply ../ sequences and query strings via webhook, chat, or...
Goploy: Arbitrary File Read Via Path Traversal In /deploy/fileDiff Allows Remote Server Compromise
Goploy System Arbitrary File Read Vulnerability Basic Information - Vulnerability Name: Goploy Endpoints Arbitrary File Read via Path Traversal - Affected Product: Goploy - Known Affected Versions: =1.17.5 Vulnerability Description Goploy is an open-source automation deployment system. A severe...
CVE-2022-51022
YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory...
CVE-2021-48014
FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer designsavesvg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a CONTENT...
CVE-2022-51022 YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint
YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory...
EUVD-2022-56066
YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory...