CVE-2025-24960

Jellystat is a free and open source Statistics App for Jellyfin. In affected versions Jellystat is directly using a user input in the routes. This can lead to Path Traversal Vulnerabilities. Since this functionality is only for admins, there is very little scope for abuse. However, the "DELETE"...

PT-2025-5604

Name of the Vulnerable Software and Affected Versions: Jellystat versions prior to 1.1.3 Description: Jellystat is a free and open source Statistics App for Jellyfin. In affected versions, Jellystat directly uses user input in the routes, which can lead to Path Traversal vulnerabilities. Although...

CVE-2025-24960: Improper Limitation of a Pathname to a Restricted Directory

Jellystat is a free and open source Statistics App for Jellyfin. In affected versions Jellystat is directly using a user input in the routes. This can lead to Path Traversal Vulnerabilities. Since this functionality is only for admins, there is very little scope for abuse. However, the DELETE...

CVE-2022-0889: Improper Neutralization of Input During Web Page Generation

The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the /includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web script...

PT-2020-16896

Name of the Vulnerable Software and Affected Versions Hrsale version 2.0.0 Description The issue allows for directory traversal, enabling the reading of arbitrary files through the download?type=files&filename=../ endpoint. Recommendations For Hrsale version 2.0.0, restrict access to the download...

CVE-2020-27993: Improper Limitation of a Pathname to a Restricted Directory

Hrsale 2.0.0 allows download?type=files&filename=../ directory traversal to read arbitrary files...