CVE-2025-24960: Improper Limitation of a Pathname to a Restricted Directory

Jellystat is a free and open source Statistics App for Jellyfin. In affected versions Jellystat is directly using a user input in the routes. This can lead to Path Traversal Vulnerabilities. Since this functionality is only for admins, there is very little scope for abuse. However, the DELETE...

CVE-2022-0889: Improper Neutralization of Input During Web Page Generation

The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the /includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web script...

CVE-2020-27993: Improper Limitation of a Pathname to a Restricted Directory

Hrsale 2.0.0 allows download?type=files&filename=../ directory traversal to read arbitrary files...