96 matches found
halo-2.25.4-CVE-2026-67919
Authenticated Remote Code Execution RCE via Unvalidated Plugin URI Installation in Halo 2.25.4 1. Vulnerability Summary A critical security vulnerability has been identified in Halo version 2.25.4. The application provides an administrative endpoint to install or upgrade plugins from a remote URI...
MINI-PF4J-833V-FR45
Bulletin has no description...
MINI-PF4J-XW3G-QPF2
Bulletin has no description...
Path Traversal
pf4j is vulnerable to Path Traversal. The vulnerability is due to improper handling of zip entry names, where a lack of proper path normalization and validation can allow directory traversal or Zip Slip attacks...
Linux Distros Unpatched Vulnerability : CVE-2025-70952
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pf4j before 20c2f80 has a path traversal vulnerability in the extract function of Unzip.java, where improper handling of zip entry names can allow directory...
EUVD-2025-209006
pf4j before 20c2f80 has a path traversal vulnerability in the extract function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation...
GHSA-5458-7HH9-V7P4 pf4j is vulnerable to Path Traversal or Zip Slip attack through improper handling of zip entry names
pf4j before 20c2f80 has a path traversal vulnerability in the extract function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation...
org.pf4j:pf4j-spring (0.4.0) potentially affected by CVE-2025-70952 via org.pf4j:pf4j (2.0.0)
org.pf4j:pf4j MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pf4j:pf4j and may be impacted: - org.pf4j:pf4j-spring 0.4.0 Source cves: CVE-2025-70952 Source advisory: OSV:GHSA-5458-7HH9-V7P4...
org.pf4j:pf4j-wicket (1.0.0) potentially affected by CVE-2025-70952 via org.pf4j:pf4j (2.1.0)
org.pf4j:pf4j MAVEN version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pf4j:pf4j and may be impacted: - org.pf4j:pf4j-wicket 1.0.0 Source cves: CVE-2025-70952 Source advisory: OSV:GHSA-5458-7HH9-V7P4...
org.pf4j:pf4j-spring (0.5.0) potentially affected by CVE-2025-70952 via org.pf4j:pf4j (2.3.0)
org.pf4j:pf4j MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pf4j:pf4j and may be impacted: - org.pf4j:pf4j-spring 0.5.0 Source cves: CVE-2025-70952 Source advisory: OSV:GHSA-5458-7HH9-V7P4...
com.bitplan.dragtop:com.bitplan.dragtop (>=0.0.1, <=0.0.2), com.bitplan.pdfextractor:com.bitplan.pdfextractor (0.0.1) +4 more potentially affected by CVE-2025-70952 via org.pf4j:pf4j (2.4.0)
org.pf4j:pf4j MAVEN version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pf4j:pf4j and may be impacted: - com.bitplan.dragtop:com.bitplan.dragtop =0.0.1, =5.0.0, =5.0.0, =1.0.2.release, =1.0.6.release Source cves: CVE-2025-70952 Source...
com.gitee.starblues:springboot-plugin-framework (>=1.0-release, <=2.1.4-release), com.gitee.starblues:springboot-plugin-framework-extension-mybatis (>=2.0-release, <=2.1.4-release) +36 more potentially affected by CVE-2025-70952 via org.pf4j:pf4j (2.6.0)
org.pf4j:pf4j MAVEN version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pf4j:pf4j and may be impacted: - com.gitee.starblues:springboot-plugin-framework =1.0-release, =2.0-release, =1.0.8.release, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0,...
care.better.pf4j:pf4j-kotlin-symbol-processing (>=1.0.0-rc1, <=2.3.10-1.0.4), cn.sliew:carp-dist (>=0.0.1, <=0.0.34) +810 more potentially affected by CVE-2025-70952 via org.pf4j:pf4j (>=3.0.1, <=3.14.0)
org.pf4j:pf4j MAVEN version =3.0.1, =1.0.0-rc1, =0.0.1, =0.0.42, =0.0.63, =0.0.64, =0.0.66, =0.0.63, =0.0.49, =0.0.61, =0.0.61, =0.0.13, =0.0.1, =0.0.33, =0.0.33, =0.0.33, =0.0.34 and more Source cves: CVE-2025-70952 Source advisory: OSV:GHSA-5458-7HH9-V7P4...
care.better.pf4j:pf4j-kotlin-symbol-processing (>=1.0.0-rc1, <=2.3.10-1.0.4), cn.sliew:carp-dist (>=0.0.1, <=0.0.34) +810 more potentially affected by CVE-2025-70952 via org.pf4j:pf4j (>=3.0.1, <=3.14.0)
org.pf4j:pf4j MAVEN version =3.0.1, =1.0.0-rc1, =0.0.1, =0.0.42, =0.0.63, =0.0.64, =0.0.66, =0.0.63, =0.0.49, =0.0.61, =0.0.61, =0.0.13, =0.0.1, =0.0.33, =0.0.33, =0.0.33, =0.0.34 and more Source cves: CVE-2025-70952 Source advisory: SNYK:JAVA-ORGPF4J-15766713...
DEBIAN-CVE-2025-70952
pf4j before 20c2f80 has a path traversal vulnerability in the extract function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation...
UBUNTU-CVE-2025-70952
pf4j before 20c2f80 has a path traversal vulnerability in the extract function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation...
CVE-2025-70952
pf4j before 20c2f80 has a path traversal vulnerability in the extract function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation...
CVE-2025-70952
pf4j before 20c2f80 has a path traversal vulnerability in the extract function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation...
CVE-2025-70952
pf4j before 20c2f80 has a path traversal vulnerability in the extract function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation...
CVE-2025-70952
pf4j before 20c2f80 has a path traversal vulnerability in the extract function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation...