Filtered by CWE-73
Filtered by vendor Subscriptions
Total 425 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-25965 1 Dell 1 Powerscale Onefs 2026-02-20 6.1 Medium
Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an external control of file name or path vulnerability. A local high privilege attacker could potentially exploit this vulnerability, leading to denial of service.
CVE-2025-47956 1 Microsoft 1 Windows Security App 2026-02-20 5.5 Medium
External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally.
CVE-2025-61879 1 Infoblox 1 Nios 2026-02-19 7.7 High
In Infoblox NIOS through 9.0.7, a High-Privileged User Can Trigger an Arbitrary File Write via the Account Creation Mechanism.
CVE-2026-2604 1 Gnome 1 Evolution-data-server 2026-02-17 5.6 Medium
No description is available for this CVE.
CVE-2025-24054 1 Microsoft 23 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 20 more 2026-02-14 6.5 Medium
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-21377 1 Microsoft 24 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 21 more 2026-02-13 6.5 Medium
NTLM Hash Disclosure Spoofing Vulnerability
CVE-2025-24996 1 Microsoft 23 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 20 more 2026-02-13 6.5 Medium
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-29819 1 Microsoft 2 Azure Portal Windows Admin Center, Windows Admin Center 2026-02-13 6.2 Medium
External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally.
CVE-2025-26684 1 Microsoft 1 Defender For Endpoint 2026-02-13 6.7 Medium
External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
CVE-2025-49760 1 Microsoft 19 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 16 more 2026-02-13 3.5 Low
External control of file name or path in Windows Storage allows an authorized attacker to perform spoofing over a network.
CVE-2025-53769 1 Microsoft 1 Windows Security App 2026-02-13 5.5 Medium
External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally.
CVE-2025-54162 2 Qnap, Qnap Systems 2 File Station, File Station 5 2026-02-12 4.9 Medium
A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5068 and later
CVE-2024-38049 1 Microsoft 23 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 20 more 2026-02-11 6.6 Medium
Windows Distributed Transaction Coordinator Remote Code Execution Vulnerability
CVE-2025-62842 2 Qnap, Qnap Systems Inc. 2 Hybrid Backup Sync, Hbs 3 Hybrid Backup Sync 2026-02-05 7.8 High
An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can then exploit the vulnerability to read or modify files or directories. We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.2.0.938 and later
CVE-2025-48781 1 Scshr 1 Hr Portal 2026-02-04 7.5 High
An external control of file name or path vulnerability in the download file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to obtain partial files by specifying arbitrary file paths.
CVE-2025-48783 1 Scshr 1 Hr Portal 2026-02-04 7.5 High
An external control of file name or path vulnerability in the delete file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to delete partial files by specifying arbitrary file paths.
CVE-2025-54945 1 Sun.net 1 Ehrd Ctms 2026-01-30 9.8 Critical
An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary system commands via a malicious file by controlling the destination file path.
CVE-2025-4674 2 Golang, Gotoolchain 2 Go, Cmd/go 2026-01-29 8.6 High
The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.
CVE-2025-53912 1 Meddream 2 Pacs Premium, Pacs Server 2026-01-29 9.6 Critical
An arbitrary file read vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870. A specially crafted HTTP request can lead to an arbitrary file read. An attacker can send http request to trigger this vulnerability.
CVE-2025-0105 1 Paloaltonetworks 1 Expedition 2026-01-24 9.1 Critical
An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files accessible to the www-data user on the host filesystem.