CVE-2026-109247 FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName

FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or...

CVE-2026-109247

FreeRDP versions before 3.32.0 are vulnerable to a path traversal flaw in the convert_filedescriptors_to_file_list() function located in winpr/libwinpr/clipboard/synthetic_file.c. The vulnerability occurs because the software concatenates server-supplied cFileName values from FileGroupDescriptorW...

EUVD-2026-97691

FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or...

CVE-2026-109244 FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert

FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default passwo...

CVE-2026-109244 FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert

FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default passwo...

CVE-2026-109243 FreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Key File

FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by cryptowritepem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard...

CVE-2026-109243

The FreeRDP application, versions 3.0.0 through 3.31.x , is vulnerable to an incorrect permission assignment (CWE-732) in the soft-smartcard component. Specifically, the crypto_write_pem function fails to apply owner-only permissions to private keys. On multi-user Unix hosts, local attackers can ...

CVE-2026-109243 FreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Key File

FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by cryptowritepem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard...

CVE-2026-109243

FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by cryptowritepem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard...

CVE-2023-43357-CMSmadesimple-Stored-XSS---Shortcut

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title in the My Preferences - Manage Shortcuts Attack Vectors: Scripting A vulnerability in the...

CVE-2023-36250

CVE-2023-36250 CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new record. Vulnerability Type CSV Injection Discoverer Bruno Teixeira Reference http://gnome.com Affected Product Code Base GNOME...

CVE-2026-31431

🔥 CVE-2026-31431 - "Copy Fail !!!" A surprisingly simple yet deadly local privilege escalation in the Linux kernel 📌 Overview CVE-2026-31431 nicknamed "Copy Fail" is a local privilege escalation vulnerability in the Linux kernel's cryptographic subsystem, specifically affecting the algifaead...

CVE-2025-60719-AFD.SYS

!IMPORTANT This proof of concept is for demonstration and learning purposes only. Use it with care. CVE-2025-60719-AFD.SYS Akamai researchers have created a new AI capability for instant root-cause analysis. The tool is a supervised multi-agent system, dubbed Patchdiff-AI. In this article we are...

CVE-2024-24488

CVE-2024-24488 An issue in Shenzen Tenda Technology CP3V2.0 V11.10.00.2311090948 allows a local attacker to obtain sensitive information via the password component. Tested Versions CP3V2.0 - V11.10.00.2311090948 CWE CWE-313: Cleartext Storage in a File or on Disk Vulnerability Overview Devices...

CVE-2019-5418

CVE-2019-5418: Ruby on Rails Path Traversal & Arbitrary File Read This project is an environment for practicing and reproducing the local file inclusion vulnerability CVE-2019-5418 in Ruby on Rails. This vulnerability allows reading arbitrary files on the server through path traversal via the...

c-CVE-2024-0044

CVE 2024 0044 CVE-2024-0044, identified in the createSessionInternal function of the PackageInstallerService.java file, is a high-severity vulnerability affecting Android versions 12 and 13. This vulnerability allows an attacker to perform a "run-as any app" attack, leading to local escalation of...

CVE-2023-43352-CMSmadesimple-SSTI--Content

CMSmadesimple SSTI v2.2.18 Author: Sergio Description: Server Side Template Injection SSTI vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to use native template syntax to inject a malicious payload into a template, which is then executed server-side. Attack Vectors: A SSTI...

CVE-2023-44765_ConcreteCMS-Stored-XSS---Associations

ConcreteCMS XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings. Attack Vectors: Scripting A vulnerability in the...

EUVD-2026-97511

A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack ca...

CVE-2026-108901

A vulnerability exists in the Display QR Code Rendering component of the Shenzhen HCC Technology MPOS M6 PLUS 1.31-N . By manipulating the argument alignment , an attacker can cause an improper restriction of rendered ui layers . This attack is restricted to the local network . While the vendor h...