CVE-2026-15751 mastergo-design mastergo-magic-mcp mcp__getComponentGenerator component-workflow.md execute path traversal

A security vulnerability has been detected in mastergo-design mastergo-magic-mcp up to 0.2.0. The affected element is the function execute of the file mastergo/component-workflow.md of the component mcpgetComponentGenerator. The manipulation of the argument rootPath leads to path traversal. An...

CVE-2026-15751

CVE-2026-15751 affects the mastergo-design mastergo-magic-mcp component set up to version 0.2.0. The vulnerability targets the execute function in mastergo/component-workflow.md for mcp__getComponentGenerator, where manipulation of the rootPath argument enables path traversal. Exploitation is loc...

CVE-2026-26190

Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from etcd.rootPath...

Malicious code in python-rootpath (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bb867560d676e7b79ce110b230906a9630feb223cbcb6072bff5a2636c60a3c7 Hidden code downloads, saves and import a remote script. The package itself is a clone of a legitimate "rootpath". At the time of analysis, the remote script d...

MAL-2025-191841 Malicious code in python-rootpath (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bb867560d676e7b79ce110b230906a9630feb223cbcb6072bff5a2636c60a3c7 Hidden code downloads, saves and import a remote script. The package itself is a clone of a legitimate "rootpath". At the time of analysis, the remote script d...

CVE-2024-29470

OneBlog v2.3.4 was discovered to contain a stored cross-site scripting XSS vulnerability via the component rootpath/links...

PT-2024-22916

Name of the Vulnerable Software and Affected Versions OneBlog version 2.3.4 Description The issue is related to a stored cross-site scripting XSS vulnerability. This vulnerability can be exploited via the component rootpath/links. Recommendations For OneBlog version 2.3.4, consider restricting...

CVE-2019-17175

joyplus-cms 1.6.0 allows manager/adminpic.php?rootpath= absolute path traversal...

CVE-2019-17175

joyplus-cms 1.6.0 allows manager/adminpic.php?rootpath= absolute path traversal...

PT-2019-14982

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue allows for absolute path traversal via the rootpath parameter in the manager/admin pic.php endpoint. Recommendations For joyplus-cms version 1.6.0, consider restricting access to the manager/admi...

CVE-2019-17175: Improper Limitation of a Pathname to a Restricted Directory

joyplus-cms 1.6.0 allows manager/adminpic.php?rootpath= absolute path traversal...

s-cms 2.5 - Multiple Vulnerabilities

No description provided by source. ============================================================ Exploit Title: S-CMS Multiple Vuln Date: 14/11/2010 Author: LordTittiS Greetings To: GodOfPain, SystemOveride Software Link: http://www.matteoiammarrone.com http://www.matteoiammarrone.com/public/s-cms...

Punbb 1.3.4 - Multiple Full Path Disclosure Vulnerability

No description provided by source. Exploit Title: Punbb 1.3.4 Full Path Disclosure Date: 07/11/2010 Author: SYSTEMOVERIDE, OverSecurityCrew Software Link: http://punbb.informer.com/ Vulnerability Type: Full Path Disclosure Version: 1.3.4 Vulnerability Details: The vulnerabilities are in the file...

Invision Power Board 3 - 'search_app' SQL Injection

============================================================ Exploit Title: Invision Power Board 3 Multiple Vuln Date: 13/11/2010 Author: LordTittiS Greetings To: GodOfPain, SystemOveride Software Link: http://www.invisionpower.com/ Vulnerability Type: Full Path Disclosure Version: 3.x.x All 3...

Punbb 1.3.4 Full Path Disclosure Vulnerability

Exploit for php platform in category web applications ============================================== Punbb 1.3.4 Full Path Disclosure Vulnerability ============================================== Exploit Title: Punbb 1.3.4 Full Path Disclosure Date: 07/11/2010 Author: SYSTEMOVERIDE, OverSecurityCr...

MetInfo 3.0 - PHP Code Injection

Exploit Title£ºMetInfo 3.0 PHP Code Injection Vulnerability Date:2010-10-31 Author£ºlinux520.com Team£ºhttp://www.linux520.com/ Vendor£ºhttp://www.metinfo.cn/ Dork£º"Powered by MetInfo 3.0 " Google: 400,000 + results Price£º free Language£ºPHP Greetz£ºCCAV +Description£º at 67 line of...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Direct News 4.10.2, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter to 1 admin/menu.php and 2 library/lib.menu.php; and the adminroot parameter to 3...

CVE-2010-1342: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Direct News 4.10.2, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter to 1 admin/menu.php and 2 library/lib.menu.php; and the adminroot parameter to 3...

CVE-2009-4666: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Webradev Download Protect 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSRootPath parameter to 1 Framework/EmailTemplates.class.php, 2 Customers/PDPEmailReplaceConstants.class.php, and 3...

CVE-2006-7046: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in cmpro.intern/login.inc.php for Clan Manager Pro CMPRO 1.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...