CVE-2026-15700

A security flaw has been discovered in DedeCMS 5.7.118. Affected by this vulnerability is the function ExtractFile of the file include/zip.class.php of the component Album Publishing Feature. The manipulation of the argument filename results in path traversal. The attack can be executed remotely...

GHSA-CV65-7CG8-R623 FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents

Summary The static file controllers in FacturaScripts decide whether a request is authorized by looking at the URL string instead of the canonical filesystem path. A request that starts with an allow-listed folder name but contains a ../ segment in the middle ends up serving a file from a differe...

EUVD-2026-44251

Relative path traversal in Windows Admin Center allows an authorized attacker to execute code over a network...

CVE-2026-40400

CVE-2026-40400 is a Windows PowerShell relative path traversal vulnerability that could enable an authorized attacker to execute code over a network. The CVE entry identifies a remote code execution risk with NETWORK attack vector, LOW attack complexity, and LOW privileges required, but with UI i...

CVE-2026-50663

CVE-2026-50663 affects Age of Empires II: Definitive Edition. The vulnerability is a relative path traversal in the game that could allow an unauthorized attacker to execute code over the network. The current documents specify the impact as remote code execution with high severity (CVSS 3.1: AV:N...

CVE-2026-50663

Relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code over a network...

CVE-2026-45496

The CVE-2026-45496 entry describes a path traversal vulnerability in Visual Studio Code where improper limitation of a pathname to a restricted directory allows local attackers to bypass a security feature. Affected component is Visual Studio Code (path handling/file access) with the root cause b...

CVE-2026-9108

A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening procedure, allowing path traversal...

CVE-2026-59839

A improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.8.0, FortiPAM 1.7.0 through 1.7.2, FortiPAM 1...

AZL-92424 CVE-2026-15392 affecting package perl-DBI for versions less than 1.651-1

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The completetablename method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any...

CVE-2026-11917

A path traversal security issue exists within Rockwell Automation ThinManager® software due to improper limitation of file save operations within the API. An authenticated attacker could exploit this vulnerability to write arbitrary files to restricted system directories outside of the...

CVE-2026-11944

openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy messaging sent-mail attachment download functionality that allows an authenticated attacker to read arbitrary files on the server via crafted path traversal sequences...

CVE-2026-15700 DedeCMS Album Publishing Feature zip.class.php ExtractFile path traversal

A security flaw has been discovered in DedeCMS 5.7.118. Affected by this vulnerability is the function ExtractFile of the file include/zip.class.php of the component Album Publishing Feature. The manipulation of the argument filename results in path traversal. The attack can be executed remotely...

CVE-2026-15700 DedeCMS Album Publishing Feature zip.class.php ExtractFile path traversal

A security flaw has been discovered in DedeCMS 5.7.118. Affected by this vulnerability is the function ExtractFile of the file include/zip.class.php of the component Album Publishing Feature. The manipulation of the argument filename results in path traversal. The attack can be executed remotely...

CVE-2026-15700

CVE-2026-15700 affects DedeCMS 5.7.118 in the Album Publishing Feature; specifically the ExtractFile function in include/zip.class.php. The vulnerability arises from manipulating the filename argument, enabling path traversal and remote execution. Public exploit information exists. Documented imp...

Exploit for CVE-2026-0740

ninja-form-exploit CVE-2026-0740 — Multi-threaded vulnera...

CVE-2026-11944

CVE-2026-11944 affects openSIS Classic 9.3. The vulnerability is an authenticated path traversal in the legacy messaging SentMail attachment download functionality, allowing an authenticated attacker to read arbitrary files on the server via crafted path traversal sequences. Impact is limited to ...

CVE-2026-11944 openSIS Classic 9.3 - Authenticated path traversal in SentMail attachment download

openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy messaging sent-mail attachment download functionality that allows an authenticated attacker to read arbitrary files on the server via crafted path traversal sequences...

CVE-2026-11944 openSIS Classic 9.3 - Authenticated path traversal in SentMail attachment download

openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy messaging sent-mail attachment download functionality that allows an authenticated attacker to read arbitrary files on the server via crafted path traversal sequences...

CVE-2026-59839

A improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.8.0, FortiPAM 1.7.0 through 1.7.2, FortiPAM 1...