MAL-2026-12793 Malicious code in helixbox-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45774464be73a3ba586a4eb9af5a89b3f2439a4f49a80c0b69eb4668cfcf7f89 The helixbox-connect bin opens a WebSocket to the hardcoded relay wss://helixbox-relay.onrender.com and dispatches messages from the peer into local...

CVE-2026-46748

A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 6. The affected system includes a binary that is configured with the capdacoverride capability. This capability allows the process to bypass file system permission checks, resulting in unrestricted file system access...

CVE-2020-36909: Improper Limitation of a Pathname to a Restricted Directory

SnapGear Management Console SG560 3.1.5 contains a file manipulation vulnerability that allows authenticated users to read, write, and delete files using the editconfigfiles CGI script. Attackers can manipulate POST request parameters in /cgi-bin/cgix/editconfigfiles to access and modify files...

PT-2025-41318

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.8 Description Flowise is a drag and drop user interface used to build customized large language model flows. Versions prior to 3.0.8 contain a flaw in the WriteFileTool and ReadFileTool components where file path...

EUVD-2025-6883

Malicious code in bioql PyPI...

EUVD-2025-23247

Malicious code in bioql PyPI...

EUVD-2023-2177

Malicious code in bioql PyPI...

CVE-2025-27024: Improper Handling of Insufficient Permissions or Privileges

Unrestricted access to OS file system in SFTP service in Infinera G42 version R6.1.3 allows remote authenticated users to read/write OS files via SFTP connections. Details: Account members of the Network Administrator profile can access the target machine via SFTP with the same credentials used f...

CVE-2021-22967

In Concrete CMS formerly concrete 5 below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit...

Exploit for Path Traversal in Gl-Inet Gl-Ax1800_Firmware

GL-AX1800 Router Security Assessment Report Overview This...

CVE-2024-1167 SEW-EURODRIVE MOVITOOLS MotionStudio Improper Restriction of XML External Entity Reference

When SEW-EURODRIVE MOVITOOLS MotionStudio processes XML information unrestricted file access can occur...

SEW-EURODRIVE MOVITOOLS MotionStudio Code Issue Vulnerability

SEW-EURODRIVE MOVITOOLS MotionStudio is an engineering software from SEW-EURODRIVE. A security vulnerability exists in SEW-EURODRIVE MOVITOOLS MotionStudio version 6.5.0.2, which originates from the possibility of unrestricted file access when processing XML messages...

CVE-2024-1167: Improper Restriction of XML External Entity Reference

When SEW-EURODRIVE MOVITOOLS MotionStudio processes XML information unrestricted file access can occur...

PT-2024-17177

Name of the Vulnerable Software and Affected Versions SEW-EURODRIVE MOVITOOLS MotionStudio affected versions not specified Description The issue arises when SEW-EURODRIVE MOVITOOLS MotionStudio processes XML information, leading to unrestricted file access. This can result in information disclosu...

CVE-2021-37539

Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution...

CVE-2021-37539

Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution...

CVE-2021-37539

Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution...

CVE-2017-11177

TRITON AP-EMAIL 8.2 before 8.2 IB does not properly restrict file access in an unspecified directory...

CVE-2017-11177: Improper Input Validation

TRITON AP-EMAIL 8.2 before 8.2 IB does not properly restrict file access in an unspecified directory...

VehicleWorkshop - Arbitrary File Upload

Exploit Title: VehicleWorkshop Unrestricted File Upload or Shell Upload Exploit Author: Touhid M.Shaikh Date: 1/08/2017 Vendor Homepage: https://github.com/spiritson/VehicleWorkshop Tested on : Kali Linux 2.0 64 bit and Windows 7 =================== Vulnerable Page: ===================...