CVE-2026-72572 o1lab xmysql - Unauthenticated Path Traversal via name Query Parameter

A path traversal vulnerability in o1lab/xmysql all versions allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user-controlled req.query.name parameter in path.joincwd, name without sanitization before...

PT-2024-9607

Name of the Vulnerable Software and Affected Versions PwnDoc versions prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 Description The issue is related to the res.download function in the template.js script, which is part of the PwnDoc tool for automating report documentation. It allows a...

@saltcorn/server arbitrary file zip read and download when downloading auto backups

Summary A user with admin permission can read and download arbitrary zip files when downloading auto backups. The file name used to identify the zip file is not properly sanitized when passed to res.download API. Details - file:...