EUVD-2025-14499

Malicious code in bioql PyPI...

CVE-2025-28055

upset-gal-web v7.1.0 /api/music/v1/cover.ts contains an arbitrary file read vulnerabilit...

CVE-2025-28055

upset-gal-web v7.1.0 /api/music/v1/cover.ts contains an arbitrary file read vulnerabilit...

CVE-2025-28055

upset-gal-web v7.1.0 /api/music/v1/cover.ts contains an arbitrary file read vulnerabilit...

CVE-2025-28055

The application upset-gal-web version 7.1.0 is vulnerable to an arbitrary file read vulnerability located in the /api/music/v1/cover.ts endpoint. This flaw stems from an improper limitation of a pathname to a restricted directory (CWE-22), potentially allowing an attacker to read sensitive files ...

CVE-2025-28055

upset-gal-web v7.1.0 /api/music/v1/cover.ts contains an arbitrary file read vulnerabilit...

CVE-2025-28055

upset-gal-web v7.1.0 /api/music/v1/cover.ts contains an arbitrary file read vulnerabilit...

CVE-2025-28055: Improper Limitation of a Pathname to a Restricted Directory

upset-gal-web v7.1.0 /api/music/v1/cover.ts contains an arbitrary file read vulnerabilit...

PT-2025-20918 · Unknown · Upset-Gal-Web

Name of the Vulnerable Software and Affected Versions: upset-gal-web version 7.1.0 Description: The issue concerns an arbitrary file read. It affects the /api/music/v1/cover.ts endpoint. Recommendations: For version 7.1.0, consider restricting access to the /api/music/v1/cover.ts endpoint until a...