CVE-2026-69252 Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...

CVE-2018-20525

Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php...

simplehttpserver path traversal vulnerability (CNVD-2018-25186)

simplehttpserver is a Python based HTTP server for testing, development and debugging of projects. A path traversal vulnerability exists in simplehttpserver 0.2.1 and earlier versions. An attacker can use this vulnerability to list arbitrary files in other folders in the web root directory...

CVE-2018-3787

Path traversal in simplehttpserver v0.2.1 allows listing any file on the server...

RuubikCMS 1.1.1 (tinybrowser.php, folder param) - Path Traversal Vulnerability

No description provided by source. Exploit Title: ruubikcms v1.1.1 Path Traversal vulnerability Google Dork: powered by ruubikcms Date: 2013-6-5 Exploit Author: expl0i13r Vendor Homepage: http://www.ruubikcms.com/ Software Link: http://www.ruubikcms.com/ruubikcms/download.php?f=ruubikcms111.zip...

RuubikCMS 1.1.1 - Path Traversal Vulnerability

ruubikcms is vulnerable to Path traversal vulnerability, when logged in with any user account, list of files and directory names present on server will be displayed by changing path in URL, this vulnerability exist in "tinybrowser.php" Also using the same vulnerability we can create folders on...