1886 matches found
CVE-2025-26357
CVE-2025-26357 affects Q-Free MaxTime (Maxtime) prior to 2.11.0. A Path Traversal in maxtime/api/database/database.lua allows an authenticated remote attacker to read sensitive files via crafted HTTP requests. Impact is read access to sensitive files; no exploitation details beyond that are provi...
CVE-2025-26357
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests...
CVE-2025-26356
CVE-2025-26356 affects Q-Free MaxTime
CVE-2025-26356
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua setActive endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests...
CVE-2025-26355
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests...
CVE-2025-26355
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests...
CVE-2025-26355
CVE-2025-26355 describes a CWE-35 path traversal in Q-Free MaxTime. The vulnerability resides in maxtime/api/database/database.lua and affects MaxTime versions less than or equal to 2.11.0. An authenticated remote attacker could delete sensitive files by crafting HTTP requests. The connected sour...
CVE-2025-26354
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua copy endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests...
CVE-2025-26354
CVE-2025-26354 concerns Q-Free MaxTime
CVE-2025-26353
CVE-2025-26353 corresponds to a CWE-35 Path Traversal in Q-Free MaxTime
CVE-2025-26353
A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests...
CVE-2025-26352
A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests...
CVE-2025-26352
The CVE-2025-26352 entry documents a CWE-35 path traversal in the template deletion mechanism of Q-Free MaxTime (≤ v2.11.0). An authenticated remote attacker can delete sensitive files via crafted HTTP requests, due to the insecure handling in the deletion path. Impact is described as the ability...
CVE-2025-26352
A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests...
CVE-2025-26351
CVE-2025-26351 describes a CWE-35 path traversal in the template download mechanism of Q-Free MaxTime (versions ≤ 2.11.0). An authenticated remote attacker can read sensitive files via crafted HTTP requests. Root cause: improper validation in the template download flow enabling path traversal. Im...
CVE-2025-26351
A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests...
CVE-2025-26351
A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests...
CVE-2025-26350
A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to upload malicious files via crafted HTTP requests...
CVE-2025-26350
A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to upload malicious files via crafted HTTP requests...
CVE-2025-26350
CVE-2025-26350 corresponds to a CWE-434 vulnerability in Q-Free MaxTime up to version 2.11.0, where the template file uploads allow an authenticated remote attacker to upload malicious files via crafted HTTP requests. The root cause is an unrestricted upload of files with dangerous types in the t...