CVE-2026-51925

A Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c within the dfm-menu_report.php component. This flaw allows a remote attacker to read arbitrary files on the server, including system files , source code , or sensitive configuration files , potentially leading to t...

CVE-2026-49984 Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local internal-storage backend validates user-supplied paths for .. traversal before it converts Windows-style backslashes to forward slashes. An attacker can therefore smuggle a traversal sequence past...

CVE-2026-49984

CVE-2026-49984 – Kestra : A path traversal vulnerability in the LocalStorage backend allows any authenticated user who can view an execution to read arbitrary files on the server. Before patching, the LocalStorage path validator mishandles Windows-style backslashes, letting an attacker smuggle tr...

Linknat VOS Manager 安全漏洞

Linknat VOS Manager is a VOS web operating platform for mobile use by China Kunshi Network Linknat. A security vulnerability exists in Linknat VOS Manager versions prior to 2.1.9.07, which stems from a path traversal attack that could result in reading arbitrary files on the server...

CVE-2023-29919

SolarView Compact = 6.0 is vulnerable to Insecure Permissions. Any file on the server can be read or modified because texteditor.php is not restricted...

Webware Webdesktop 代码问题漏洞

Webware Webdesktop is an application software from the company Webware in the Republic of Estonia. A document management software. A code issue vulnerability exists in Webware Webdesktop version 5.1.15. The vulnerability stems from the system allowing an attacker to read all files on the server. ...

CVE-2020-7953

An issue was discovered in OpServices OpMon 9.3.2. Without authentication, it is possible to read server files e.g., /etc/passwd due to the use of the nmap -iL aka input file option...

Design/Logic Flaw

It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed...