CRM Platform Path Traversal DoS

The vulnerability of the platform for creating individual web applications in CRM involves incorrect restrictions on the path to the catalog. Exploiting this vulnerability could allow a malicious actor to delete arbitrary files remotely...

iFlightDoc Path Traversal Unauthorized Access

The vulnerability of the iFlightDoc onboard documentation system is related to an incorrect limitation on the name of the path to the catalog h. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the protected information...

CVE-2024-40725

HTTP Request Smuggling Detection Tool This repository contains a Python-based tool to detect HTTP Request Smuggling vulnerabilities, specifically targeting CVE-2024-40725. The tool attempts to exploit this vulnerability in Apache HTTP Server by sending crafted HTTP requests and analyzing the...

cve-2025-8110-GOGS-RCE

GOGS RCE cve-2025-8110 Gogs is a lightweight and self-hosted Git service similar to a private version of GitHub, designed to run easily on low-resource servers. The CVE-2025-8110 vulnerability is a critical security flaw that allows an attacker to bypass path restrictions by using symlinks. By...

CVE-2026-116249

A flaw was found in pgAdmin. In multi-user server mode, the application fails to properly restrict file paths and connection settings to a user's designated storage directory. An authenticated attacker can supply manipulated file paths to access sensitive credentials belonging to other users,...

CVE-2026-115908

A flaw was found in the zip library. During archive extraction, the software fails to properly resolve intermediate symbolic links shortcuts pointing to other file locations, relying instead on superficial path comparisons. By providing a specially crafted archive, an attacker can bypass path...

CVE-2026-120213

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded...

CVE-2026-120213 @fastify/http-proxy vulnerable to prefix escape via decoded route parameters

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded...

CVE-2026-120213

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded...

CVE-2026-120213

The @fastify/http-proxy Fastify plugin (versions 9.0.0 through 11.6.5 ) is vulnerable to a path-restriction bypass. When using parameterized prefix and rewritePrefix options, the plugin substitutes URL-decoded route parameters into the prefix without re-encoding them. This allows an unauthenticat...

EUVD-2026-115117

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded...

CVE-2026-120213 @fastify/http-proxy vulnerable to prefix escape via decoded route parameters

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded...

CVE-2026-120213 @fastify/http-proxy vulnerable to prefix escape via decoded route parameters

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded...

PT-2026-135398

Name of the Vulnerable Software and Affected Versions @fastify/http-proxy versions 9.0.0 through 11.6.5 Description When an application utilizes parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into...

CVE-2026-120213: @fastify/http-proxy: @fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded...

ROS-20261023-73-0157

The vulnerability in Jenkins is related to an incorrect restriction on the path to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

ROS-20261019-73-0062

The vulnerability in the vault relates to an incorrect restriction on the path to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

Apache Kylin security vulnerabilities

A security vulnerability exists in Apache Kylin versions 4.0.0 through 5.0.4. This vulnerability stems from path restriction bypass during metadata backup deletion and may affect services directly exposed to the public network...

WNLTK WekaClassifier File Read Write

The vulnerability of the WekaClassifier module in the NLTK library for symbolic and statistical processing of natural language is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to read...

Astra Linux – Vulnerability in mapserver

Versions of MapServer prior to 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 do not properly enforce the MSMAPNOPATH and MSMAPPATTERN restrictions, which are intended to control the locations from which a mapfile can be loaded via MapServer CG...