CVE-2025-66645

CVE-2025-66645 - NiceGUI Directory Traversal : Plenty of connected sources confirm a vulnerability in NiceGUI (

CVE-2025-66645 NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading

NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to directory traversal through the App.addmediafiles function, which allows a remote attacker to read arbitrary files on the server filesystem. This issue is fixed in version 3.4.0...

EUVD-2025-201452

The warehouse management system version 1.2 contains an arbitrary file read vulnerability. The endpoint /file/showImageByPath does not sanitize user-controlled path parameters. An attacker could exploit directory traversal to read arbitrary files on the server's file system. This could lead to th...

CVE-2025-66550

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download link of a file on the same Nextcloud server, the file would be downloaded without the user confirming the action. This...

CVE-2016-20023

CKSource CKFinder for ASP.NET versions before 2.5.0.1 are affected. An authenticated user could download arbitrary server files by supplying the correct path, indicating an insecure path/file access mechanism. The issue impacts CKFinder’s file download functionality and could expose confidential ...

CKSource CKFinder 安全漏洞

CKSource CKFinder is a file management and uploading tool from CKSource, Inc. A security vulnerability exists in CKSource CKFinder versions prior to 2.5.0.1, which originates from an authenticated user being able to download arbitrary files on the server via the correct path...

SUSE CVE-2025-27232

An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss...

Grav Path Traversal Vulnerability (CNVD-2025-30350)

Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms and one-page product presentations. Grav suffers from a path traversal vulnerability that can be exploited by a low-privileged user to read server files, which can be exploited by an attacke...

CVE-2025-66302

Grav CMS path traversal vulnerability (CVE-2025-66302) exists prior to 1.8.0-beta.27 in the backup tool’s input sanitization, enabling authenticated administrators to read arbitrary files on the server filesystem outside the webroot. Impact depends on the privileges of the Grav process account; f...

CVE-2025-66302 Grav vulnerable to Path Traversal allowing server files backup

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A path traversal vulnerability has been identified in Grav CMS, allowing authenticated attackers with administrative privileges to read arbitrary files on the underlying server filesystem. This vulnerability arises due to insufficient inp...

CVE-2025-66206 Frappe vulnerable to a path traversal allowing reading certain files

Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, certain requests were vulnerable to path traversal attacks, wherein some files from the server could be retrieved if the full path was known. Sites hosted on Frappe Cloud, and even other setups that are behind a rever...

CVE-2025-66206

CVE-2025-66206 affects Frappe, a full-stack web application framework. Prior to versions 15.86.0 and 14.99.2 , certain requests were vulnerable to path traversal, enabling retrieval of server files if the full path was known. The issue mainly impacts installations directly using werkzeug/gunicorn...

Grav 路径遍历漏洞

Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms and one-page product presentations. Grav suffers from a path traversal vulnerability that can be exploited by a low-privileged user to read server files, which can be exploited by an attacke...

Frappe Technologies Frappe 路径遍历漏洞

Frappe Technologies Frappe is a metadata-driven full-stack web application framework based on Python and JavaScript from Frappe Technologies, India. A path traversal vulnerability exists in Frappe Technologies Frappe versions prior to 15.86.0 and prior to 14.99.2, which stems from a path traversa...

PT-2025-48561

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.8.0-beta.27 Description Grav CMS contains a path traversal flaw. Authenticated attackers with administrative privileges can read arbitrary files on the server filesystem. This is due to inadequate input sanitization...

CVE-2025-66370

Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem...

Exploit for Path Traversal in Grafana

CVE-2021-43798 CVE-2021-43798 is a high-severity path traversa...

Exploit for Path Traversal in Grafana

CVE-2021-43798 CVE-2021-43798 is a high-severity path traversa...

PT-2025-48006

The AI Engine for WordPress: ChatGPT, GPT Content Generator plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1. This is due to insufficient validation of user-supplied file paths in the 'lqdai update post' AJAX endpoint and the use of file get...

Logic flaw vulnerability in the multimedia integrated business display system of Beijing Shenzhou Vision Han Technology Co., Ltd. (CNVD-C-2025-852060)

Ltd. is a deep-rooted enterprise in the field of visualization. A logic flaw vulnerability exists in the multimedia integrated business display system of Beijing Divine Vision Han Technology Co. Ltd, which can be exploited by attackers to delete server files...