CVE-2025-30208

CVE-2025-30208 — Vite 임의 파일 읽기 · v5 CVE: CVE-2025-30208 GHSA: GHSA-x574-m823-4x7w 심각도: CVSS 5.3 중간 네트워크 접근 가능한 개발 서버 ⚠ 승인된 보안 평가 용도로만 사용하세요. 소유하지 않았거나 명시적 서면 허가를 받지 않은 시스템에 대한 무단 사용은 불법입니다. 설명 Vite 개발 서버는 /@fs/ 요청을 통해 호스트 파일시스템의 임의 파일을 제공할 수 있습니다. 영향을 받는 버전에서는 쿼리 문자열 검증 누락으로 인해 공격자가 특수하게 조작된 접미사를...

CVE-2026-19091 GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleterevision function in all versions up to, and including, 2.8.169. This makes it possible for...

WordPress GeoDirectory plugin <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision vulnerability

Authenticated Subscriber+ Arbitrary File Deletion via 'posttype' Parameter via Query-String Bypass in geodirsavepost + geodirdeleterevision vulnerability discovered by mak3bread in WordPress Plugin GeoDirectory versions = 2.8.169...

Incorrect Authorization

Overview @cedar-policy/authorization-for-expressjs is a Middlewares to authorize expressJS applications with Cedar Affected versions of this package are vulnerable to Incorrect Authorization through improper matching of incoming requests using req.originalUrl. An attacker can gain unauthorized...

CVE-2026-41428

Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public no-auth endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query string, an attacker can access any protected endpoint ...

CVE-2026-41062 WWBN/AVideo has an incomplete fix for a directory traversal bypass via query string in ReceiveImage downloadURL parameters

WWBN AVideo is an open source video platform. In versions 29.0 and below, the directory traversal fix introduced in commit 2375eb5e0 for objects/aVideoEncoderReceiveImage.json.php only checks the URL path component via parseurl$url, PHPURLPATH for .. sequences. However, the downstream function...

GHSA-V2WJ-Q39Q-566R Vite: `server.fs.deny` bypassed with queries

Summary The contents of files that are specified by server.fs.deny can be returned to the browser. Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network using --host or server.host config option - the sensitive file exists in th...

CVE-2025-30208

Vite, a frontend development tool, contains an arbitrary file read vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. The flaw exists because trailing separators like ? are removed during request processing but are not accounted for in query string regexes. Attackers can...

CVE-2025-30208

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. "@fs" denies access to files outside of Vite serving allow list. Adding "?raw??" or "?import&raw??" to the URL bypasses this limitation and returns the file content...

CVE-2011-3140: Undefined Security Weakness

IBM Web Application Firewall, as used on the G400 IPS-G400-IB-1 and GX4004 IPS-GX4004-IB-2 appliances with update 31.030, does not properly handle query strings with multiple instances of the same parameter, which allows remote attackers to bypass intended intrusion prevention by dividing a...