140957 matches found
CVE-2025-63589
CVE-2025-63589 CMSimpleXH index.php 路径处理中的反射型 XSS 发现日期： 2025年10月6日 产品： CMSimpleXH（开源平面文件 CMS） 受影响版本： 1.8 CVE 编号： CVE-2025-63589 是否需要认证： 不需要（未认证） 攻击类型： 反射型跨站脚本（XSS） 估算 CVSS v3.1： AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N → 6.1（中危） index.php 中的前端控制器接受动态路径段（用于路由到模板/页面），并将这些值传递给模板渲染。代码在将这些路径段插入到属性和锚点 href...
CVE-2026-83742
Unsigned integer underflow in wstrncat in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSHRealPath in src/ssh.c...
CVE-2026-83742
The wolfSSL wolfSSH library (versions v1.4.11 through v1.5.0 ) is vulnerable on non-Windows platforms due to an unsigned integer underflow in the wstrncat() function within src/port.c. An authenticated remote attacker can trigger this by sending a crafted SFTP path to wolfSSH_RealPath() in src/ss...
CVE-2026-83742 wstrncat() unsigned integer underflow leads to an off-by-one null write in wolfSSH on non-Windows platforms
Unsigned integer underflow in wstrncat in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSHRealPath in src/ssh.c...
CVE-2026-83742 wstrncat() unsigned integer underflow leads to an off-by-one null write in wolfSSH on non-Windows platforms
Unsigned integer underflow in wstrncat in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSHRealPath in src/ssh.c...
DELMIA Apriso - Command Injection
An Improper Control of Generation of Code code injection / file upload → RCE vulnerability affecting DELMIA Apriso Release 2020 → Release 2025. When an authenticated user can upload files and the upload handler fails to canonicalize filenames or enforce storage restrictions, an attacker may place...
Kyocera TASKalfa printer - Path Traversal
CCRX has a Path Traversal vulnerability. Path Traversal is an attack on web applications. By manipulating the value of the file path, an attacker can gain access to the file system, including source code and critical system settings. id: CVE-2023-34259 info: name: Kyocera TASKalfa printer - Path...
Craft CMS - Remote Code Execution via Template Path Manipulation
This template identifies a critical Remote Code Execution RCE vulnerability in Craft CMS, identified as GHSA-2p6p-9rc9-62j9. The vulnerability exists due to improper handling of the --templatesPath query parameter, allowing attackers to execute arbitrary code by referencing malicious Twig...
ZKTeco BioTime v8.5.5 - Path Traversal
A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. id: CVE-2023-38950 info: name: ZKTeco BioTime v8.5.5 - Path Traversal author: iamnoooob,pdresearch severity: high description: | A pa...
Zimbra Collaboration - Unrestricted File Upload
An issue was discovered in Zimbra Collaboration ZCS 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole extraction to /opt/zimbra/jetty/webapps/zimbra/public that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also,...
QNAP Photo Station - Path Traversal
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files. id: CVE-2019-7195 info: name: QNAP Photo Station - Path Traversal author: s4e-io severity: critical description: | QNAP devices running Pho...
pgAdmin < 6.17 - Unauthenticated Remote Code Execution
pgAdmin prior to 6.17 contains an insecure HTTP API caused by improper access control, letting unauthenticated users execute arbitrary external utilities via path manipulation, exploit requires no authentication. id: CVE-2022-4223 info: name: pgAdmin 6.17 - Unauthenticated Remote Code Execution...
LG LED Assistant - Thumbnail Path Traversal File Upload
A path traversal vulnerability exists in the endpoint handler for /api/thumbnail in Common.js. An unauthenticated remote attacker can exploit this to upload arbitrary files to any location on the disk drive where the product is installed. id: CVE-2024-2863 info: name: LG LED Assistant - Thumbnail...
CVE-2026-97671
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability...
CVE-2026-44011-poc
CVE-2026-44011：Craft CMS 认证后 RCE PoC 该 Python 脚本改编自 Craft CMS 安全公告 中描述的利用方式。已认证的 Craft 用户可访问存在漏洞的字段布局配置路径，并导致服务器执行命令。 适用范围与要求 受影响的版本为 Craft CMS =4.0.0, =5.0.0, 5.9.18。 该脚本要求两台主机上都安装有 curl。它在服务器上使用 Bash。服务器上的 Python3 还可提供交互式 PTY；若没有 Python3，shell 将回退为基本连接。 用法 Confirm the host is vulnerable python3...
CVE-2025-56499
CVE-2025-56499 通过本地规则提供者中缺失的路径验证实现任意文件读取 上游修复：https://github.com/MetaCubeX/mihomo/pull/2177 受影响版本：mihomo = v1.19.11 摘要 在解析 rule-providers 配置时，type = "file" 分支未能对提供的路径进行验证。通过身份验证的攻击者控制 schema.Path 后，可以将提供者指向任何可读的本地文件。由于大多数任意文件不符合预期的规则格式，解析错误（包括大量文件内容片段）会引入内存日志，并通过 /logs API 暴露。由于 mihomo...
CVE-2025-52691
CVE-2025-52691 SmarterMail 未授权任意文件上传远程代码执行 概述 严重未授权任意文件上传，允许远程代码执行。 字段| 值 ---|--- 产品| SmarterMail 受影响版本| Build 9406 及更早 CVSS| 10.0（严重） 类型| 任意文件上传 攻击向量| HTTP（未授权） 影响| 远程代码执行 攻击流程 flowchart LR AAttacker -- B"Find Upload Endpoint" B -- C"/api/upload" C -- D"Upload ASPX Shell" D -- E"Path Traversal" ...
cve-2021-21980-mock-server
Clippy of the Dead - CVE-2021-21980 测试环境与Nuclei模板 本仓库包含一个用于检测 CVE-2021-21980（vSphere Web Client 路径遍历）的高置信度 Nuclei 模板，以及一个模拟该漏洞行为的小型模拟环境，用于安全的本地测试。 文件： cve-2021-21980.yaml：包含多种编码变体和匹配器的 Nuclei 模板 app.py：模拟 /eam/vib 路径遍历漏洞的小型 Flask 应用 Dockerfile：带有自签名 TLS 证书的模拟服务器容器镜像 docker-compose.yml：运行模拟服务器，监听主...
CVE-2026-97671
IBM Langflow OSS versions 1.0.0 through 1.12.2 are susceptible to a path traversal vulnerability (CWE-22 ). This flaw could allow a remote authenticated attacker to obtain sensitive information . No specific exploit details, impacts beyond information disclosure, or remediation steps are provided...
