PT-2025-27477 · Ansible · Ansible Automation Platform

Name of the Vulnerable Software and Affected Versions: Ansible Automation Platform affected versions not specified Description: A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This issue...

Exploit for CVE-2025-30208

🔥 CVE-2025-30208 Vite Arbitrary File Read Vulnerability Scanne...

Roo Code 注入漏洞

Roo Code is an AI-based autonomous coding agent from Roo Code. An injection vulnerability exists in Roo Code versions prior to 3.20.3, which stems from the searchfiles tool not restricting the reading of files outside of the VS Code workspace, which could lead to the reading of sensitive files...

PT-2025-26996 · Leadsec · Leadsec Ssl Vpn

Name of the Vulnerable Software and Affected Versions: Leadsec SSL VPN formerly Lenovo NetGuard affected versions not specified Description: A path traversal issue exists, allowing unauthenticated attackers to read arbitrary files on the system via the ostype parameter in the...

PHPGurukul Pre-School Enrollment System Project 安全漏洞

The Pre-School Enrollment System Project is a preschool enrollment system project. A directory traversal vulnerability exists in Pre-School Enrollment System Project, which stems from a lack of validity checking of paths when handling directory requests in manage-classes.php, and can be exploited...

PT-2025-26687 · Unknown · Sysmonelixir

Name of the Vulnerable Software and Affected Versions: SysmonElixir versions prior to 1.0.1 Description: The issue concerns SysmonElixir, a system monitor HTTP service in Elixir. Prior to version 1.0.1, the "/read" endpoint reads any file from the server's file system, including sensitive files...

CVE-2025-34023

A path traversal vulnerability exists in the Karel IP1211 IP Phone's web management panel. The /cgi-bin/cgiServer.exx endpoint fails to properly sanitize user input to the page parameter, allowing remote authenticated attackers to access arbitrary files on the underlying system by using crafted...

CVE-2025-34023

A path traversal vulnerability exists in the Karel IP1211 IP Phone's web management panel. The /cgi-bin/cgiServer.exx endpoint fails to properly sanitize user input to the page parameter, allowing remote authenticated attackers to access arbitrary files on the underlying system by using crafted...

CVE-2025-34023

CVE-2025-34023 affects the Karel IP1211 IP Phone, specifically the web management panel. The vulnerability is a path traversal in the "/cgi-bin/cgiServer.exx" endpoint where the page parameter is not sanitized, allowing remote authenticated attackers to access arbitrary files on the device. Explo...

CVE-2025-34023 Karel IP Phone IP1211 Path Traversal

A path traversal vulnerability exists in the Karel IP1211 IP Phone's web management panel. The /cgi-bin/cgiServer.exx endpoint fails to properly sanitize user input to the page parameter, allowing remote authenticated attackers to access arbitrary files on the underlying system by using crafted...

PT-2025-26459 · Karel · Karel Ip1211 Ip Phone

Name of the Vulnerable Software and Affected Versions: Karel IP1211 IP Phone affected versions not specified Description: A path traversal issue exists in the web management panel, specifically affecting the "/cgi-bin/cgiServer.exx" endpoint. This endpoint fails to properly sanitize user input to...

PT-2025-25675 · Unknown · Mojoomla Wpgym

Name of the Vulnerable Software and Affected Versions: mojoomla WPGYM versions n/a through 65.0 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via Script Runner tool. An attacker as an authenticated user can request any file from the Docker container via /script-api/scripts/ endpoint since these are stored in default location. Details A Directory Traversal...

Unauthorized Access To Uploaded Media Files

Nautobot is vulnerable to unauthorized access to uploaded media files. The vulnerability is due to improper access control on the file-serving endpoint, allowing attackers to access and download sensitive files without authentication by guessing or knowing their URLs...

PT-2025-26488 · Maven · Org.Geonetwork-Opensource:Gn-Web-App +1

Impact GeoNetwork WFS Index functionality is affected by GeoTools XML External Entity XXE vulnerability during schema validation. This vulnerability is particularly severe as the REST API endpoint was not secured, potentially allowing unauthenticated attackers to read sensitive files Patches...

GHSA-HXRR-X32W-CG8G HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter

Summary An authenticated Local File Inclusion LFI vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as...

HAX 安全漏洞

HAX is HAX The Web open source a HAX+CMS microsite managed using a PHP backend. A security vulnerability exists in HAX versions prior to 11.0.0 that stems from a local file inclusion vulnerability that could lead to the reading of sensitive files...

PT-2025-24104 · Unknown · Ai Mortgage Calculator

Name of the Vulnerable Software and Affected Versions: AI Mortgage Calculator versions n/a through 1.0.1 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File...

SolarWinds Serv-U 15.4.2 HF1 - Directory Traversal

Exploit Title: SolarWinds Serv-U 15.4.2 HF1 - Directory Traversal Date: 2025-05-28 Exploit Author: @ibrahimsql Exploit Author's github: https://github.com/ibrahimsql Vendor Homepage: https://www.solarwinds.com/serv-u-managed-file-transfer-server Software Link:...

CVE-2025-46822

OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized...