CVE-2025-27610 Local File Inclusion in Rack::Static

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, Rack::Static can serve files under the specified root: even if urls: are provided, which may expose other files under the specified root: unexpectedly. The vulnerability occurs becaus...

CVE-2025-27610 Local File Inclusion in Rack::Static

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, Rack::Static can serve files under the specified root: even if urls: are provided, which may expose other files under the specified root: unexpectedly. The vulnerability occurs becaus...

CVE-2025-27610

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, Rack::Static can serve files under the specified root: even if urls: are provided, which may expose other files under the specified root: unexpectedly. The vulnerability occurs becaus...

Cross-site Scripting (XSS)

serve-static is vulnerable to Cross-site Scripting XSS. The vulnerability is due to passing untrusted user input, even after sanitization, to the redirect function, which may lead to the execution of untrusted code...

01-numacert (>=1.0.0 <=3.0.0), 02-infrastructure (=1.0.0) +18530 more potentially affected by CVE-2024-43800 via serve-static (>=1.0.1 <=1.15.0)

serve-static NPM version =1.0.1, =1.0.0, =1.0.0, =1.0.3, =0.1.0, =0.2.0, =0.2.2 and more Source cves: CVE-2024-43800 Source advisory: OSV:GHSA-CM22-4G7W-348P...

AZL-49094 CVE-2024-43800 affecting package nodejs-nodemon 2.0.3-4

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

UBUNTU-CVE-2024-43800

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

PT-2024-23104 · Tenda · Tenda F1203

Name of the Vulnerable Software and Affected Versions: Tenda FH1203 version 2.0.1.6 Description: A critical vulnerability was found in the function fromSetRouteStatic of the file /goform/fromRouteStatic. The manipulation of the argument entrys leads to a stack-based buffer overflow. The attack ca...

GHSA-5G97-WHC9-8G7J node-static and @nubosoftware/node-static vulnerable to Directory Traversal

node-static and its fork, @nubosoftware/node-static, are vulnerable to Directory Traversal due to improper file path sanitization in the startsWith method in the servePath function...

277snippet-cli (>=1.0.0 <=1.0.2), 40au-isteven-angular-multiselect (=4.0.0) +739 more potentially affected by CVE-2023-26111 via node-static (>=0.5.6 <=0.7.9)

node-static NPM version =0.5.6, =1.0.0, =1.0.5, =0.0.5, =0.0.1, =0.0.1, =17.0.6 and more Source cves: CVE-2023-26111 Source advisory: SNYK:JS-NODESTATIC-3149928...

40au-isteven-angular-multiselect (=4.0.0), @abcd19/st-grid (=3.1.0) +723 more potentially affected by CVE-2025-11149 via node-static (>=0.5.6 <=0.7.11)

node-static NPM version =0.5.6, =1.0.5, =0.0.5, =0.0.1, =0.0.1, =17.0.6 - @beadswap/lib =0.0.1 and more Source cves: CVE-2025-11149 Source advisory: OSV:GHSA-8R4G-CG4M-X23C...

277snippet-cli (>=1.0.0 <=1.0.2), 40au-isteven-angular-multiselect (=4.0.0) +739 more potentially affected by CVE-2025-11149 via node-static (>=0.5.6 <=0.7.9)

node-static NPM version =0.5.6, =1.0.0, =1.0.5, =0.0.5, =0.0.1, =0.0.1, =17.0.6 and more Source cves: CVE-2025-11149 Source advisory: SNYK:JS-NODESTATIC-1297183...

efw (=0.1.0) potentially affected by CVE-2020-36209 via late-static (=0.3.0)

late-static CARGO version =0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on late-static and may be impacted: - efw =0.1.0 Source cves: CVE-2020-36209 Source advisory: OSV:RUSTSEC-2020-0102...

Denial Of Service (DoS)

node-static is vulnerable to denial of service DoS. The attack exists because it does not properly handle the argument 'path', allowing the attacker to input the path \u0000 NULL to crash fs.stat with the error message "TypeError ERRINVALIDARGVALUE: The argument 'path' must be a string or...

WordPress arcResBookingWidget 1.0 Cross Site Scripting Vulnerability

WordPress arcResBookingWidget plugin version 1.0 suffers from a cross site scripting vulnerability. Title: WordPress 'arcResBookingWidget' Plugin Version: 1.0 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-16 Download: - https://wordpress.org/plugins/arcres-booking-engine/ -...

WordPress Altos Connect Widget 1.3.0 Cross Site Scripting Vulnerability

WordPress Altos Connect Widget plugin version 1.3.0 suffers from a cross site scripting vulnerability. Title: WordPress 'Altos Connect Widget' Plugin Version: 1.3.0 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-15 Download: - https://wordpress.org/plugins/altos-connect/ -...

WordPress Admin Pack By Site Caseiro 1.1 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Title: WordPress 'Admin Pack by SITE CASEIRO' Plugin Version: 1.1 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-14 Download: - https://wordpress.org/plugins/admin-pack-by-site-caseiro/ -...

WordPress Chief Editor 3.6.1 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Title: WordPress 'Chief Editor' Plugin Version: 3.6.1 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-17 Download: - https://wordpress.org/plugins/chief-editor/ - https://plugins.svn.wordpress.org/chief-editor/ Notified...

WordPress F/T/G Social Widgets 1.3.7 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Title: WordPress 'Facebook, Twitter & Google+ Social Widgets' Plugin Version: 1.3.7 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-15 Download: - https://wordpress.org/plugins/facebook-twitter-google-social-widgets/ -...

WordPress Customize Youtube Videos 0.2 Cross Site Scripting

Title: WordPress 'Customize Youtube Videos' Plugin Version: 0.2 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-16 Download: - https://wordpress.org/plugins/customize-youtube-videos/ - https://plugins.svn.wordpress.org/customize-youtube-videos/ Notified Vendor/WordPress:...