CVE-2026-107508

The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file...

CVE-2026-106032: Server-Side Request Forgery (SSRF)

Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrar...

Joomla! Component com_janews - Local File Inclusion Detection

A directory traversal vulnerability in the JA News comjanews component 1.0 for Joomla! allows remote attackers to read arbitrary local files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in the JA News...

CVE-2026-66007

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the filename metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted filename values with directory traversal...

PT-2026-80682

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file name values with directory travers...

PT-2026-105473

Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file name values with directory traversal...

CVE-2026-33581

OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and fileUrl alias parameters that bypass localRoots validation. Remote attackers can exploit this by routing file requests through unvalidate...

CVE-2024-8055

Vanna v0.6.3 is vulnerable to SQL injection via Snowflake database in its file staging operations using the "PUT" and "COPY" commands. This vulnerability allows unauthenticated remote users to read arbitrary local files on the victim server, such as "/etc/passwd", by exploiting the exposed SQL...

CVE-2024-5753

vanna-ai/vanna version v0.3.4 is vulnerable to SQL injection in some file-critical functions such as "pgreadfile". This vulnerability allows unauthenticated remote users to read arbitrary local files on the victim server, including sensitive files like "/etc/passwd", by exploiting the exposed SQL...

CVE-2022-44644

In Apache Linkis =1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary local files by connecting a rogue MySQL server, By adding allowLoadLocalInfile to true in the JDBC parameter. Therefore, the parameters in the JDBC URL should be...

CVE-2021-43836

Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. The problem is patched with the Versions 1.6.44, 2.2.18...

CVE-2020-27017: Improper Restriction of XML External Entity Reference

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA 9.1 is vulnerable to an XML External Entity Processing XXE vulnerability which could allow an authenticated administrator to read arbitrary local files. An attacker must already have obtained product administrator/root privileges to...

PT-2020-13930

Name of the Vulnerable Software and Affected Versions WebFOCUS Business Intelligence version 8.0 SP6 Description The administration portal in the affected software allows remote attackers to read arbitrary local files or forge server-side HTTP requests via a crafted HTTP request to "/ibi...

CVE-2017-9416

Directory traversal vulnerability in tools.fileopen in Odoo 8.0, 9.0, and 10.0 allows remote authenticated users to read arbitrary local files readable by the Odoo service...

CVE-2007-4180: Undefined Security Weakness

Directory traversal vulnerability in data/inc/theme.php in Pluck 4.3, when registerglobals is enabled, allows remote attackers to read arbitrary local files via a .. dot dot in the file parameter. NOTE: CVE and a reliable third party dispute this vulnerability because the code uses a fixed argume...