CVE-2021-29447

WordPress XXE漏洞：CVE-2021-29447 具有上传恶意WAVE文件能力（例如作者）的用户，可以利用WordPress媒体库中的XML解析问题，导致XXE攻击，进而可能导致文件系统信息泄露 漏洞代码 XML外部实体（XXE）漏洞 XML提供了定义自定义实体的可能性，这些实体可以在整个文档中重复使用。例如，这可以用于避免重复。以下代码定义了一个实体myEntity供后续使用。 定义的实体的值也可以来源于URI引用的外部源。在这种情况下，它们被称为外部实体：...

Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability

A vulnerability in the Open Client Interface OCI XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution...

CVE-2026-66489 Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox 2.20.2...

EUVD-2026-50336

Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox 2.20.2...

CVE-2026-66489

Technical details about CVE-2026-66489 are not publicly available in the provided documents. Monitor for updates from vendors and security feeds to obtain affected versions, impact, and remediation once disclosed.

CVE-2026-53422

A flaw was found in Erlang OTP's Secure Shell SSH component, specifically within the SSH File Transfer Protocol SFTP daemon's sshsftpd module. An authenticated SFTP user can exploit an observable response discrepancy in the REALPATH handler to enumerate the existence of files and directories...

CVE-2025-43024

CVE-2025-43024 relates to HP ThinPro 8.1 SP8 and involves a GUI dialog that allows unauthorized viewing of files on the file system. The root cause is an insufficient access check in the dialog that displays file-system contents, enabling information disclosure. Public details across connected so...

CVE-2025-11371

CVE-2025-11371 is an unauthenticated Local File Inclusion (LFI) exists in Gladinet CentreStack and TrioFox. Connected documents describe an LFI affecting CentreStack/TrioFox via the default installation, enabling reading of server files through the /storage/t.dn endpoint by abusing an unsafely sa...

EUVD-2019-13658

Malware in sbrugna...

EUVD-2022-45547

Malicious code in bioql PyPI...

EUVD-2023-29227

Malicious code in bioql PyPI...

EUVD-2023-47488

Malicious code in bioql PyPI...

CVE-2025-3981

The CVE-2025-3981 entry concerns wowjoy Zhejiang HuZhou Huazhuo Information Technology Co., Ltd. Internet Doctor Workstation System v1.0. The vulnerability is tied to improper authorization in the endpoint /v1/prescription/details/, potentially allowing remote, unauthenticated access to processin...

CVE-2023-43067

Dell Unity prior to 5.3 contains an XML External Entity injection vulnerability. An XXE attack could potentially exploit this vulnerability disclosing local files in the file system...

CVE-2022-42477

An improper input validation vulnerability CWE-20 in FortiAnalyzer version 7.2.1 and below, version 7.0.6 and below, 6.4 all versions may allow an authenticated attacker to disclose file system information via custom dataset SQL queries...

Input validation

An improper input validation vulnerability CWE-20 in FortiAnalyzer version 7.2.1 and below, version 7.0.6 and below, 6.4 all versions may allow an authenticated attacker to disclose file system information via custom dataset SQL queries...

CVE-2022-42477

An improper input validation vulnerability CWE-20 in FortiAnalyzer version 7.2.1 and below, version 7.0.6 and below, 6.4 all versions may allow an authenticated attacker to disclose file system information via custom dataset SQL queries...

CVE-2021-33662

Under certain conditions, the installation of SAP Business One, version - 10.0, discloses sensitive information on the file system allowing an attacker to access information which would otherwise be restricted...

Microsoft Windows Device Management Enrollment Service Directory Junction Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

CVE-2020-12777 Combodo iTop - Broken Access Control

A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information...