CVE-2025-59744 Multiple vulnerabilities in AndSoft's e-TMS

Path traversal vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to access files only within the web root using the “docurl” parameter in “/lib/asp/DOCSAVEASASP.ASP”...

CVE-2025-59744 Multiple vulnerabilities in AndSoft's e-TMS

Path traversal vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to access files only within the web root using the “docurl” parameter in “/lib/asp/DOCSAVEASASP.ASP”...

CVE-2025-59744

AndSoft e-TMS v25.03 suffers a path traversal in the docurl parameter of /lib/asp/DOCSAVEASASP.ASP, due to insufficient filtering of path elements. This allows access to files within the web root. Documented in multiple sources (NVD/CNVD/CNNVD) with no explicit remediation details provided in the...

PT-2025-40364

Name of the Vulnerable Software and Affected Versions AndSoft's e-TMS version 25.03 Description A path traversal issue exists in AndSoft's e-TMS version 25.03. This allows an attacker to access files within the web root. The issue is related to the docurl parameter in the...

CVE-2021-4459

An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensitive system information of the affected Sunny Boy devices...

PT-2025-31211 · Undefined · Undefined

Sitecore Experience Platform XP prior to 8.0 Initial Release rev. 141212 and Content Management System CMS prior to 7.2 Update-3 rev. 141226 and prior to 7.5 Update-1 rev. 150130 contain a vulnerability that may allow an attacker to download files under the web root of the site when the name of t...

CVE-2025-41240 Mounted Kubernetes Secrets under a predictable path located within the web server document root

Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path /opt/bitnami//secrets that is located within the web server document root. In affected versions, this can lead to unauthenticated access to sensitive credentials via HTTP/S. A remote attacker could retrieve these secrets ...

CVE-2005-1658

Directory traversal vulnerability in filemanager.cpp in MyServer 0.8 allows remote attackers to list the parent directory of the web root via a URL with a "..." triple dot...

WordPress plugin CYAN Backup 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

EsafeNet CDG 安全漏洞

EsafeNet CDG is a document security management system from EsafeNet, China. A security vulnerability exists in EsafeNet CDG version 5. An attacker can exploit the vulnerability to access files and directories stored outside the web root folder...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the component /index.php?page=backup/export. An attacker can access files and directories stored outside of the web server's root directory by manipulating file paths in the input. PoC php Details A Directory...

CVE-2024-5018

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Path Traversal vulnerability exists Wug.UI.Areas.Wug.Controllers.SessionController.LoadNMScript. This allows allows reading of any file from the applications web-root directory...

Unitronics Unistream Unilogic Path Traversal Vulnerability

Unitronics Unistream Unilogic is an integrated controller software platform from Unitronics Corporation for developing and programming the Unistream family of programmable logic controllers PLCs. A security vulnerability exists in Unitronics Unistream Unilogic versions prior to 1.35.227. An...

Apache OFBiz Security Vulnerability

Apache OFBiz is the United States Apache Apache Foundation of a set of enterprise resource planning ERP system. The system provides a complete set of Java-based web application components and tools. A security vulnerability exists in Apache OFBiz versions prior to 18.12.12. An attacker could...

Sharp JH-RV11 Security Vulnerability

Sharp JH-RV11 is an energy management controller for cloud services from Sharp Japan. A security vulnerability exists in Sharp JH-RV11 Ver.B0.1.9.1 version and earlier versions. An attacker could exploit the vulnerability to access files and directories stored outside of the web root folder...

CPIO Security Vulnerabilities

cpio is a file backup program for UNIX-like systems. A security vulnerability exists in CPIO. An attacker could exploit the vulnerability to access files and directories stored outside of the web root folder...

Biges Safe Life Technologies Electronics VGuard Security Breach

Biges Safe Life Technologies Electronics VGuard is a CCTV monitoring solution from Biges Safe Life Technologies Electronics. A security vulnerability exists in versions prior to Biges Safe Life Technologies Electronics VGuard V500.0003.R008.4011.C0012.B351. An attacker could exploit the...

CVE-2023-26578

Arbitrary file upload to web root in the IDAttend’s IDWeb application 3.1.013 allows authenticated attackers to upload dangerous files to web root such as ASP or ASPX, gaining command execution on the affected server...

elFinder 路径遍历漏洞

elFinder is a set of Drupal-based platform , open source AJAX file manager . The product provides multi-file upload, image scaling and other features. A security vulnerability exists in versions prior to elFinder 2.1.62. An attacker can use this vulnerability to access files and directories store...

Lightdash 路径遍历漏洞

Lightdash is visual data analysis tool. A security vulnerability exists in Lightdash versions prior to 0.510.3. An attacker can exploit the vulnerability to access files and directories stored outside of the web root folder...