Lucene search
+L
PypaMost viewed

7218 matches found

PyPA
PyPA
added 2026/07/13 3:46 p.m.21 views

Lemur: JWT verifier honors attacker-supplied alg, enabling ATO

Lemur 1.9.0: JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure Vulnerability Summary Field | Value-- | --Title | Lemur 1.9.0: JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap;...

4.8CVSS6AI score
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.21 views

python-engineio has unbound thread allocation that can cause denial of service

ImpactAn attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection is received, and when the client sends a PONG packet.Note: this issue primarily affects synchronous servers...

7.5CVSS6.1AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.21 views

python-socketio: Binary attachment accumulation can cause denial of service

ImpactThe python-socketio server stores binary EVENT and ACK messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. An attacker can submit a binary message and intentionally omit sending one or more of its...

7.5CVSS6.1AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.21 views

zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet

Impactreadcharacterstring and readstring in src/zeroconf/protocol/incoming.py sliced self.dataself.offset : self.offset + length and advanced self.offset by the declared length without checking it against self.datalen. Python's slice silently returns fewer bytes when the end index runs past the...

7.1CVSS6.1AI score0.00203EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.21 views

PGHoard: Password written to debug log

ImpactWhen using .pgpass, database connection information including the username and password will be logged at the debug level. PatchesUpgrade to version 2.7.1 or greater. WorkaroundsFilter out debug-level logs. ReferencesThis issue was discovered by BugCrowd user DRAKOKORIAN...

2.4CVSS6.1AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.21 views

Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration

SummaryOpen WebUI has a Broken Object Level Authorization BOLA vulnerability in the builtin searchknowledgefiles tool.When native function calling is enabled and the selected model has no attached knowledge bases, an authenticated user can call searchknowledgefiles with an arbitrary knowledgeid...

4.3CVSS6.1AI score0.00259EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.21 views

Open WebUI: Forged chat-file link allows cross-user file read and deletion

SummaryOpen WebUI v0.9.5 lets an authenticated user attach arbitrary fileid values to their own chat message without checking whether they own or can read those files. If the attacker then shares that chat and grants themselves read access, hasaccesstofile treats the victim file as accessible...

8.3CVSS6.2AI score0.00292EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.21 views

yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

SummaryA vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files such as .desktop, .url, .webloc to the user's filesystem, bypassing the remediation for CVE-2024-38519. DetailsThe fix for CVE-2024-38519 enforced an allowlist for file extensions, in order ...

9.6CVSS6.2AI score0.0062EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.21 views

tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

Tornado's gzip decompression routines work in limited-size chunks, but have no overall limit for the total size of decompressed chunks that they will accumulate There has always been a limit for the total compressed size. This allows a malicious server to consume effectively unlimited amounts of...

7.5CVSS6.1AI score0.00572EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.21 views

pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W 0 0 0 values and large /Size values. PatchesThis has been fixed in pypdf==6.12.0. WorkaroundsIf developers are unable to upgrade their apps immediately, they...

5.1CVSS6AI score0.00124EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/13 3:35 p.m.21 views

praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}

SummaryType: Authorization bypass enabling workspace metadata + settings tampering. The PATCH /workspaces/workspaceid endpoint is gated only by requireworkspacememberworkspaceid default minrole="member". Any member can rewrite the workspace's name, description, and the settings JSON blob. The...

6.5CVSS6.2AI score0.00195EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:35 p.m.21 views

praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

SummaryType: Insecure Direct Object Reference. The project CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/projects/projectid and GET .../projectid/stats gate access on requireworkspacememberworkspaceid only, then resolve projectid through ProjectService.getprojectid / updateprojectid...

8.1CVSS6.1AI score0.00289EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:35 p.m.21 views

praisonai-platform: Missing authorization on member removal enables full workspace takeover by any user regardless of role

SummaryType: Authorization bypass enabling owner lockout. The DELETE /workspaces/workspaceid/members/userid endpoint is gated only by requireworkspacememberworkspaceid default minrole="member". Any member can remove any other member, including the workspace owner, using a single DELETE. There is ...

8.1CVSS6.1AI score0.00284EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:35 p.m.21 views

PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context

SummaryPraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins.If a prompt contains @url:, the CLI calls MentionsParser.process.... The @url: handler then performs a direct urllib.request.urlopen request to the attacker-controlled URL an...

5.5CVSS6.2AI score0.00129EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:35 p.m.21 views

PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate

SummaryThe fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named four vulnerable handlers in mcpserver/adapters/clitools.py: "registers four file-handling tools by default, praisonai.rules.create, praisonai.rules.show, praisonai.rules.delete, and...

9.6CVSS6.1AI score0.0062EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.21 views

OpenStack Neutron has an Incorrect Authorization issue

In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under the default policy, permitting a project reader to create and update tags...

5.3CVSS6.1AI score0.00295EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.21 views

compliance-trestle - jinja has an Arbitrary File Write via Path Traversal

Relevant Products/Components: trestle/core/commands/author/jinja.py trestle author jinja--- Detailed Description:The -o/--output argument in trestle author jinja allows writing files outside the intended workspace.The application does not properly validate: ../ ..\ absolute pathsThis allows...

8.4CVSS6.4AI score0.0005EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.21 views

pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API

SummaryThe SSRF mitigation added in commit 33c55da for GHSA-7gvf-3w72-p2pg is incomplete. The PREREQFUNCTION-based private IP check was correctly applied to HTTPChunk download path but not to HTTPRequest used by the parseurls API. An authenticated attacker can supply a URL pointing to an...

5CVSS6.2AI score0.00176EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.21 views

Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line Arguments

JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of...

8.7CVSS6.1AI score0.00156EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.21 views

Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator

SummaryA path traversal vulnerability exists in Pipecat's development runner src/pipecat/runner/run.py. When the runner is started with the --folder flag, it exposes a GET /files/filename:path download endpoint. The filename path parameter is concatenated directly onto args.folder with no...

7.5CVSS7AI score0.00423EPSS
SaveExploits1References8Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.21 views

Open WebUI vulnerable to blind server side request forgery (SSRF) via the PDF generate function

SummaryBlind server side request forgery SSRF via the PDF generate function. The finding resulted from a penetration test for a customer. It is suspected that the root cause of the issue lies within the core of Open WebUI, which is why it is being reported as a security issue here. Tested on Open...

5.4CVSS6.3AI score0.00186EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.21 views

dbt MCP Server Logs Tool Arguments Including SQL Queries and Credentials in Plaintext Without Redaction When File Logging Is Enabled

Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation. SummaryDbtMCP.calltool in src/dbtmcp/mcp/server.py logs the complete raw arguments dictionary at INFO level on every tool invocation line 67 and again at ERROR level if the call...

2.5CVSS6.2AI score0.00148EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.21 views

aiwaves-cn agents is vulnerable to resource consumption in the recall_relevant_memories_to_working_memory function

A weakness has been identified in aiwaves-cn agents up to e8c4e3c2d19739d3dff59e577d1c97090cc15f59. Affected by this issue is the function recallrelevantmemoriestoworkingmemory of the file core/cat/lookingglass/straycat.py of the component cheshirecatcore. This manipulation causes resource...

6.9CVSS5.9AI score0.0038EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.21 views

eml_parser has recursion DoS via nested message/rfc822 attachments

SummaryEmlParser.getrawbodytext recurses unconditionally for every nested message/rfc822 attachment without any depth limit. An attacker who can supply a badly crafted EML file with approximately 120 nested message/rfc822 parts triggers an unhandled RecursionError and aborts parsing of the messag...

6.3CVSS6.2AI score0.00396EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.21 views

Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal

CONFIDENTIAL KL-CAN-2024-002 Vulnerability Details| | Field | Value ||---|-------|-------|| 1 | Discoverer | Jaggar Henry & Sean Segreti of KoreLogic, Inc. || 2 | Date Submitted | 2024.03.12 || 3 | Title | Open WebUI Arbitrary File Upload + Path Traversal || 5 | Affected Vendor | Open WebUI || 6 ...

9.8CVSS7.3AI score0.00336EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.21 views

Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels

Deactivated Channel Members Retain Full Access to Group/DM Channels Affected ComponentChannel membership authorization check:- backend/openwebui/models/channels.py lines 663-673, isuserchannelmember- Used at 15 locations in backend/openwebui/routers/channels.py Affected VersionsCurrent main branc...

5.4CVSS6.1AI score0.00178EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.21 views

OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints

OpenStack Cyborg before 16.0.1 uses rule:allow checkstr='@' as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complet...

7.4CVSS6.2AI score0.00206EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.21 views

OpenStack Ironic has an Incorrect Resource Transfer Between Spheres

An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token which provides access to all OpenStack services Ironic is authorized for; o...

7.7CVSS6.1AI score0.00433EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.21 views

Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection

SummaryFides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion...

6.1CVSS6AI score0.00309EPSS
SaveExploits0References10Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.21 views

wireshark-mcp vulnerable to arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured

Description Impactwireshark-mcp exposes a wiresharkexportobjects MCP tool that accepts an attacker-controlled destdir parameter and passes it to tshark's --export-objects flag with no mandatory path restriction.The path sandbox alloweddirs is None by default and only activates when the environmen...

6.8CVSS6.2AI score0.00281EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2026/07/13 2:36 p.m.21 views

Home Assistant has stored XSS in history-graphs

SummaryThe "remaining charge time"-sensor for mobile phones imported/included from Android Auto it appears is vulnerable to the same issue as CVE-2025-62172.This also indicates that any sensor showing their name in the history-graph, is likely to be vulnerable to this issue. DetailsAnother entity...

8.8CVSS6.2AI score0.00202EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
added 2026/07/13 2:36 p.m.21 views

Arbitrary file write via tar traversal in mlflow

A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use of tarfile.extractall without path validation enables crafted tar.gz files containing .. or absolute paths to escape the intended extractio...

9.1CVSS7.2AI score0.00852EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:36 p.m.21 views

PySpector has a Plugin Sandbox Bypass leads to Arbitrary Code Execution

SummaryPySpector versions = 0.1.6 are affected by a security validation bypass in the plugin system. The validateplugincode function in pluginsystem.py, performs static AST analysis to block dangerous API calls before a plugin is trusted and executed. However, the internal resolvename helper only...

8.3CVSS6.5AI score0.00169EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2026/07/13 2:36 p.m.21 views

Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters

SummaryGraphiti versions before 0.28.2 contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values supplied through SearchFilters.nodelabels were concatenated directly into Cypher label expressions without validation.In M...

8.1CVSS6.3AI score0.00344EPSS
SaveExploits2References8Affected Software1
PyPA
PyPA
added 2026/07/13 2:36 p.m.21 views

NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution

NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering...

8.8CVSS6.2AI score0.00521EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 2:36 p.m.21 views

Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading

SummaryTensorFlow / Keras continues to honor HDF5 “external storage” and ExternalLink features when loading weights. A malicious .weights.h5 or a .keras archive embedding such weights can direct loadweights to read from an arbitrary readable filesystem path. The bytes pulled from that path popula...

7.5CVSS6.3AI score0.00298EPSS
SaveExploits0References9Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.21 views

FPE in `tf.image.generate_bounding_box_proposals`

ImpactWhen running on GPU, tf.image.generateboundingboxproposals receives a scores input that must be of rank 4 but is not checked.pythonimport tensorflow as tfa = tf.constantvalue=1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0b =...

7.5CVSS6.9AI score0.00439EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.21 views

TensorFlow vulnerable to segfault in `QuantizedAvgPool`

ImpactIf QuantizedAvgPool is given mininput or maxinput tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack.pythonimport tensorflow as tfksize = 1, 2, 2, 1strides = 1, 2, 2, 1padding = "SAME"input = tf.constant1, shape=1,4,4,2,...

7.5CVSS6.9AI score0.00424EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.21 views

TensorFlow vulnerable to `CHECK` fail in `SetSize`

ImpactWhen SetSize receives an input setshape that is not a 1D tensor, it gives a CHECK fails that can be used to trigger a denial of service attack.pythonimport tensorflow as tfarg0=1arg1=1,1arg2=1arg3=Truearg4=''tf.rawops.SetSizesetindices=arg0, setvalues=arg1, setshape=arg2,...

7.5CVSS6.9AI score0.00411EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/07 4:42 p.m.21 views

picklescan missing detection by simple obfuscation of a `builtins.eval` call

SummaryAn unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the host loading a pickle payload from an untrusted source. DetailsIt's possible to hide the eval call nested under another callable via getattr. PoCpythonimport builtinsclass EvilClass:...

9.8CVSS6.4AI score0.00519EPSS
SaveExploits0References9Affected Software1
PyPA
PyPA
added 2026/07/07 4:3 p.m.21 views

docling-core vulnerable to Remote Code Execution via unsafe PyYAML usage

ImpactA PyYAML-related Remote Code Execution RCE vulnerability, namely CVE-2020-14343, is exposed in docling-core =2.21.0, 2.48.4 and, specifically only if the application uses pyyaml 5.4 and invokes doclingcore.types.doc.DoclingDocument.loadfromyaml passing it untrusted YAML data. PatchesThe...

10CVSS6.2AI score0.05984EPSS
SaveExploits2References9Affected Software1
PyPA
PyPA
added 2026/07/07 4:3 p.m.21 views

GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS

SummaryGuardDog's safeextract function does not validate decompressed file sizes when extracting ZIP archives wheels, eggs, allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabytes of disk space from a few megabytes of compressed data. Vulnerabili...

7.5CVSS6AI score0.00431EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
added 2026/07/07 4:3 p.m.21 views

Fickling Blocklist Bypass: cProfile.run()

Fickling's assessmentcProfile was added to the list of unsafe imports https://github.com/trailofbits/fickling/commit/dc8ae12966edee27a78fe05c5745171a2b138d43. Original report Description SummaryFickling versions up to and including 0.1.6 do not treat Python's cProfile module as unsafe. Because of...

9.3CVSS6.5AI score0.00461EPSS
SaveExploits1References13Affected Software1
PyPA
PyPA
added 2026/07/07 4:3 p.m.21 views

pretix has Broken Access Control Allowing Cross-User File Access via UUID

An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...

7CVSS5.9AI score0.0022EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/07 4:3 p.m.21 views

urllib3 allows an unbounded number of links in the decompression chain

Impacturllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 e.g., Content-Encoding: gzip, zstd.However, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leadi...

8.9CVSS6AI score0.00692EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/07 4:3 p.m.21 views

trytond does not enforce access rights for the route of the HTML editor.

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...

7.1CVSS5.9AI score0.00219EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
added 2026/07/07 4:3 p.m.21 views

trytond allows remote attackers to obtain sensitive trace-back (server setup) information

Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back server setup information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...

4.3CVSS6AI score0.00281EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
added 2026/07/07 4:3 p.m.21 views

Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation

A Stored Cross-Site Scripting XSS vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed...

4.8CVSS6AI score0.00199EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2026/07/07 4:3 p.m.21 views

Byaidu PDFMathTranslate vulnerable to open redirect

An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to redirect users to arbitrary external websites via the file parameter to the /gradioapi endpoint. This vulnerability could be exploited for phishing attacks or ...

6.1CVSS6AI score0.00211EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/07 4:3 p.m.21 views

AstrBot contains a directory traversal vulnerability

AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function installpluginupload of the interface '/plugin/install-upload' parses the filename from the request body provided by the user, and directly uses the filename to assign to filepath without checking the validi...

8.7CVSS5.9AI score0.00771EPSS
SaveExploits1References5Affected Software1
Total number of security vulnerabilities5000