16 matches found
EUVD-2026-85706
Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbiddenextensions blocklist in config/mediable.php. The blocklist introduced to address CVE-2026-49972 includes phpt but omits pht, which Apache executes as PHP via...
CVE-2026-93352 Laravel-Mediable 7.0.0 < 7.0.2 RCE via .pht File Upload
Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbiddenextensions blocklist in config/mediable.php. The blocklist introduced to address CVE-2026-49972 includes phpt but omits pht, which Apache executes as PHP via...
GHSA-W8J7-39HP-8X59 Cloudreve's remote download file paths can escape the selected destination directory
Summary Cloudreve trusts file paths returned by the configured remote downloader. A downloader-reported path such as ../../escaped.txt can cause a downloaded file to be created outside the user-selected destination directory. Details In the remote download master transfer path, Cloudreve joins th...
CVE-2025-12203 givanz Vvveb Code Editor functions.php sanitizeFileName path traversal
A weakness has been identified in givanz Vvveb up to 1.0.7.3. This issue affects the function sanitizeFileName of the file system/functions.php of the component Code Editor. Executing a manipulation of the argument File can lead to path traversal. The attack can be launched remotely. The exploit...
CVE-2025-12203
Summary: CVE-2025-12203 affects givanz Vvveb up to 1.0.7.3, specifically the sanitizeFileName function in Code Editor’s file system/functions.php. The issue allows remote path traversal via manipulation of the File argument. Impact (as stated): Path traversal could lead to unauthorized file acces...
CVE-2025-12203 givanz Vvveb Code Editor functions.php sanitizeFileName path traversal
A weakness has been identified in givanz Vvveb up to 1.0.7.3. This issue affects the function sanitizeFileName of the file system/functions.php of the component Code Editor. Executing a manipulation of the argument File can lead to path traversal. The attack can be launched remotely. The exploit...
Vvveb 路径遍历漏洞
Vvveb is a powerful and easy-to-use CMS from Givan Individual Developers for building websites, blogs or e-commerce stores. A path traversal vulnerability exists in Vvveb version 1.0.7.3 and earlier, which stems from incorrect manipulation of File, a parameter of the function sanitizeFileName of...
CVE-2025-12203: Improper Limitation of a Pathname to a Restricted Directory
A weakness has been identified in givanz Vvveb up to 1.0.7.3. This issue affects the function sanitizeFileName of the file system/functions.php of the component Code Editor. Executing a manipulation of the argument File can lead to path traversal. The attack can be launched remotely. The exploit...
EUVD-2017-15367
Malware in sbrugna...
VvvebJs Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php...
CVE-2024-29272
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php...
CVE-2024-29272
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php...
CVE-2024-29272
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php...
PT-2024-22844 · Vvvebjs · Vvvebjs
Name of the Vulnerable Software and Affected Versions: VvvebJs versions prior to 1.7.5 Description: The issue allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in the "save.php" file. This enables remote attacks,...
Directory traversal
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "9 of 9. Directory Traversal using the filename; SanitizeFilename function in settings.c."...
