CVE-2023-5177

The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 exposes the full path of a file when putting in a non-existent file in a parameter of the shortcode...

CVE-2022-36904

Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system...

CVE-2025-30170

CVE-2025-30170 is an information disclosure vulnerability in ABB ASPECT product line (ASPECT-Enterprise, NEXUS Series, MATRIX Series) affecting versions up to 3.08.03. The issue arises from exposure of file path, file size, or file existence information, which can be accessed if a session adminis...

CVE-2025-30170 Admin Authorized Exposure of file path, file size or file existence

Exposure of file path, file size or file existence vulnerabilities in ASPECT provide attackers access to file system information if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through...

CVE-2025-30170 Admin Authorized Exposure of file path, file size or file existence

Exposure of file path, file size or file existence vulnerabilities in ASPECT provide attackers access to file system information if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through...

CVE-2020-5880

Om BIG-IP 15.0.0-15.0.1.3 and 14.1.0-14.1.2.3, the restjavad process may expose a way for attackers to upload arbitrary files on the BIG-IP system, bypassing the authorization system. Resulting error messages may also reveal internal paths of the server...

CVE-2020-29536

Archer before 6.8 P2 6.8.0.2 is affected by a path exposure vulnerability. A remote authenticated malicious attacker with access to service files may obtain sensitive information to use it in further attacks...

CVE-2014-100009

The Joomlaskin JS Multi Hotel aka JS MultiHotel and Js-Multi-Hotel plugin 2.2.1 and earlier for WordPress allows remote attackers to obtain the installation path via a request to 1 functions.php, 2 myCalendar.php, 3 refreshDate.php, 4 showimage.php, 5 widget.php, 6 phpthumb/GdThumb.inc.php, or 7...

CVE-2019-12215

A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because lastError.file is used in plugins/CorePluginsAdmin/templates/safemode.twig. NOTE: the vendor disputes the significance of this...

CVE-2011-3701

AlegroCart 1.2.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by common.php and certain other files...

CVE-2002-1990

Resin 2.0.5 through 2.1.2 allows remote attackers to reveal physical path information via a URL request for the example Java class file HelloServlet...

CVE-2006-4938

help.php in Moodle before 1.6.2 does not check the existence of certain help files before including them, which might allow remote authenticated users to obtain the path in an error message...

CVE-1999-0201

A quote cwd command on FTP servers can reveal the full path of the home directory of the "ftp" user...

CVE-2025-44021

A flaw was found in Ironic. It did not filter file:// paths when used as an image source except to ensure they were a file. This issue could cause config files from well-known paths to be written to disk on a node. Mitigation Currently, no mitigation is available for this vulnerability...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass through the use of request.getRequestURI validation in com.baidu.brcc.config.UserAuthFilter.doFilter. An attacker can gain unauthorized admin rights by sending requests to /admin/ URIs on misconfigured servers. Not...

CVE-2025-0049

When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhere: before 7.8.0...

CVE-2025-0049

CVE-2025-0049 affects Fortra GoAnywhere before version 7.8.0. The vulnerability stems from an error message returned when a web user without Create permission on subfolders uploads a file to a non-existent directory; the message may expose the absolute server path, which could enable fuzzing for ...

Hospital Management System doctor-specilization.php File SQL Injection Vulnerability

Hospital Management System a hospital management system. The Hospital Management System suffers from a SQL injection vulnerability that originates from a missing validation of externally entered SQL statements in the parameter doctorspecilization of the file /admin/doctor-specilization.php. An...

CVE-2025-29819

External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally...

PT-2025-6563 · WordPress +1 · Bigbuy Dropshipping Connector For Woocommerce +1

Name of the Vulnerable Software and Affected Versions: BigBuy Dropshipping Connector for WooCommerce plugin for WordPress versions up to, and including, 1.9.19 Description: The vulnerability is due to the /vendor/cocur/slugify/bin/generate-default.php file being directly accessible and triggering...