WordPress NewPath WildApricotPress Add-on - Member Directory plugin <= 1.0.0 - Unauthenticated Member PII Disclosure via REST API vulnerability

WordPress NewPath WildApricotPress Add-on - Member Directory plugin = 1.0.0 - Unauthenticated Member PII Disclosure via REST API vulnerability discovered by Huynh Kien Minh in WordPress Plugin NewPath WildApricotPress Add-on for Member Directory versions = 1.0.0...

Exploit for CVE-2026-13736

CVE-2026-13736: NewPath WildApricotPress Add-on – Member Direc...

CVE-2026-13736: Improper Access Control

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only...

CVE-2020-37087: Improper Neutralization of Input During Web Page Generation

Easy Transfer Wifi Transfer v1.7 for iOS contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scripts by manipulating the oldPath, newPath, and path parameters in Create Folder and Move/Edit functions. Attackers can exploit improper input...

EUVD-2014-3746

Malware in sbrugna...

CVE-2023-22629

An issue was discovered in TitanFTP through 1.94.1205. The move-file function has a path traversal vulnerability in the newPath parameter. An authenticated attacker can upload any file and then move it anywhere on the server's filesystem...

CVE-2023-2688

The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Path Traversal in versions up to, and including, 4.19.1 via the vulnerable parameter wfunewpath. This allows administrator-level attackers to move files uploaded with the plugin located in...

PT-2023-20838

Name of the Vulnerable Software and Affected Versions WordPress File Upload and WordPress File Upload Pro versions up to, and including, 4.19.1 Description The issue allows administrator-level attackers to move files uploaded with the plugin outside of the web root via the wfu newpath parameter...

CVE-2023-22629

An issue was discovered in TitanFTP through 1.94.1205. The move-file function has a path traversal vulnerability in the newPath parameter. An authenticated attacker can upload any file and then move it anywhere on the server's filesystem...

PT-2023-18596 · Unknown · Titan Sftp

Name of the Vulnerable Software and Affected Versions: TitanFTP versions 1.94.1205 and earlier Description: The issue concerns a path traversal vulnerability in the newPath parameter of the move-file function. This allows an authenticated attacker to upload any file and then move it to any locati...

South River Technologies TitanFTP NextGen 路径遍历漏洞

South River Technologies TitanFTP NextGen South River Technologies Titan FTP NextGen is a natively supported cluster for high availability and failover SFTP/ FTP server. A security vulnerability exists in South River Technologies TitanFTP NextGen version 1.94.1205 and prior versions, which stems...

CVE-2013-0136

Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service file deletion or renaming via 1 the uploadPath parameter...

CVE-2013-0136

Mutiny Mutiny Frontend EditDocument servlet contains directory traversal weaknesses disclosed for the Mutiny 5 appliance. The vulnerability allows authenticated users to perform operations (UPLOAD, DELETE, CUT, COPY) via injected parameters (uploadPath, paths[], newPath) to read arbitrary files, ...

Heap overflow

Multiple heap-based buffer overflows in Topaz Systems SigPlus Pro ActiveX Control 3.95, and possibly other versions before 4.29, allow remote attackers to execute arbitrary code via a long 1 KeyString property, 2 NewPath parameter to the SetLocalIniFilePath method, or 3 NewPortPath parameter to t...