16 matches found
CVE-2026-65754
Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory...
CVE-2026-65754
Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory...
EUVD-2026-47908
Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory...
CVE-2026-65754 Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension
Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory...
CVE-2026-65754 Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension
Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory...
CVE-2026-65754
CVE-2026-65754 concerns Joomla Extension RegularLabs ReReplacer Pro, with insecure path handling: ReReplacer XML include paths could read files outside the site directory. The CVSS 3.1 vector indicates network attack, low complexity, no user interaction, with high confidentiality impact and no in...
CVE-2026-61431
PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and inclu...
EUVD-2026-42897
PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and inclu...
CVE-2026-61431 PraisonAI before 4.6.78 Path Traversal via ContextGatherer
PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and inclu...
CVE-2026-61431
PraxionAI (note: the spelling in the record appears as PraisonAI) before version 4.6.78 exposes a path traversal vulnerability in the ContextGatherer. The flaw stems from failing to validate include paths in .praisoncontext and .praisoninclude files, allowing an attacker with local access to supp...
CVE-2026-59924
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory wh...
PT-2026-56517
Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0 Description Mistune is a Python Markdown parser with renderers and plugins. The Include.parse function joins and normalizes user-supplied include paths without verifying that the result remains within the intend...
CVE-2023-3279
The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks...
GHSA-QM28-7HQV-WG5J OS Command Injection in ng-packagr
The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option...
Command Injection
Overview ng-packagr is a Compile and package a TypeScript library to Angular Package Format Affected versions of this package are vulnerable to Command Injection via the styleIncludePaths option. Remediation Upgrade ng-packagr to version 10.1.1 or higher. References - GitHub Commit Credit: Snyk...