GHSA-FW82-87P8-V6HP Kirby vulnerable to path traversal of snippet names in the `snippet()` helper

TL;DR This vulnerability affects all Kirby sites that use the snippet helper or $kirby-snippet method with a dynamic snippet name such as a snippet name that depends on request or user data. Sites that only use fixed calls to the snippet helper/$kirby-snippet method i.e. calls with a simple strin...

CVE-2025-31493

Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby sites that use the collection helper or $kirby-collection method with a dynamic collection name such as a collection name that depends on request or user data...

CVE-2025-4529

A vulnerability was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. It has been classified as problematic. Affected is the function Download of the file...

PT-2025-21126 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability. This could lead to arbitrary file...

PT-2025-26301

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.5.x through 10.5.5 Mattermost versions 9.11.x through 9.11.15 Mattermost versions 10.8.x through 10.8.0 Mattermost versions 10.7.x through 10.7.2 Mattermost versions 10.6.x through 10.6.5 Description Mattermost fails to...

CVE-2025-4529

CVE-2025-4529 affects Seeyon Zhiyuan OA Web Application System 8.1 SP2. The vulnerability lies in the Download function of the ZIP File Handler within seeyon-apps-m3.jar (M3CoreController.class): manipulating the Name argument enables path traversal. Remote exploitation is possible and the exploi...

PT-2025-20667 · Unknown · Ctcms Content Management System

Name of the Vulnerable Software and Affected Versions: CTCMS Content Management System version 2.1.2 Description: A critical issue was found in the function del of the file ctcmsappscontrollersadminTpl.php of the component File Handler. The manipulation of the argument File leads to path traversa...

PT-2025-20652 · Unknown · Production Ssm +1

Name of the Vulnerable Software and Affected Versions: feng ha ha/megagao ssm-erp version 1.0 production ssm version 1.0 Description: A vulnerability was found in the function handleFileDownload of the file FileController.java of the component File Handler. The manipulation leads to path traversa...

CVE-2025-4511 vector4wang spring-boot-quick quick-img2txt Img2TxtController.java ResponseEntity path traversal

A vulnerability was found in vector4wang spring-boot-quick up to 20250422. It has been rated as critical. This issue affects the function ResponseEntity of the file /spring-boot-quick-master/quick-img2txt/src/main/java/com/quick/controller/Img2TxtController.java of the component quick-img2txt. Th...

CVE-2025-32820

CVE-2025-32820 affects SonicWall SMA100/10.x SSL-VPN appliances. An authenticated SSLVPN user with low privileges can inject a path traversal sequence to make any directory on the SMA writable (world-writable). Public write access to system dirs can enable follow-on abuse or facilitate privilege ...

CVE-2025-22479

Dell Storage Center - Dell Storage Manager, versions 20.0.21, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection...

CVE-2025-4329 74CMS index path traversal

A vulnerability was found in 74CMS up to 3.33.0. It has been rated as problematic. Affected by this issue is the function index of the file /index.php/index/download/index. The manipulation of the argument url leads to path traversal. The attack may be launched remotely. The exploit has been...

CVE-2025-4186

A vulnerability, which was classified as critical, was found in Wangshen SecGate 3600 2024. Affected is an unknown function of the file /?g=routeispinfoexportsave. The manipulation of the argument filename leads to path traversal. It is possible to launch the attack remotely. The exploit has been...

CVE-2025-4178 xiaowei1118 java_server File Upload API FoodController.java path traversal

A vulnerability was found in xiaowei1118 javaserver up to 11a5bac8f4ba1c17e4bc1b27cad6d24868500e3a on Windows and classified as critical. This issue affects some unknown processing of the file /src/main/java/com/changyu/foryou/controller/FoodController.java of the component File Upload API. The...

CVE-2025-32011 KUNBUS Revolution Pi Authentication Bypass by Primary Weakness

KUNBUS PiCtory versions 2.5.0 through 2.11.1 have an authentication bypass vulnerability where a remote attacker can bypass authentication to get access due to a path traversal...

WordPress WPMasterToolKit (WPMTK) – All in one plugin plugin <= 2.5.2 - Authenticated (Administrator+) to Arbitrary File Read and Write vulnerability

Authenticated Administrator+ to Arbitrary File Read and Write vulnerability discovered by nquangit in WordPress Plugin WPMasterToolKit versions = 2.5.2...

CVE-2025-43946

The CVE-2025-43946 entry concerns TCPWave DDI 11.34P1C2. The issue is Remote Code Execution caused by Unrestricted File Upload combined with Path Traversal, enabling an attacker to upload files and traverse directories to execute arbitrary code. CVSSv3.1 metrics indicate a NETWORK-vector, exploit...

Trace Gadgets: Minimizing Code Context for Machine Learning-Based Vulnerability Prediction

As the number of web applications and API endpoints exposed to the Internet continues to grow, so does the number of exploitable vulnerabilities. Manually identifying such vulnerabilities is tedious. Meanwhile, static security scanners tend to produce many false positives. While machine...

PT-2025-17061 · WordPress · Wp Asia Myticket Events

Name of the Vulnerable Software and Affected Versions: WP Asia MyTicket Events versions 1.2.4 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in WP Asia MyTicket Events...

PT-2025-16588 · Unknown · Misstt123 Oasys

Name of the Vulnerable Software and Affected Versions: misstt123 oasys version 1.0 Description: A vulnerability was found in the function image of the file /show, leading to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This...