Filtered by CWE-73
Filtered by vendor Subscriptions
Total 425 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-38165 1 Microsoft 2 Windows 11 22h2, Windows 11 23h2 2025-07-10 6.5 Medium
Windows Compressed Folder Tampering Vulnerability
CVE-2025-25478 1 Syspass 1 Syspass 2025-07-09 6.5 Medium
The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. This mismanagement leads to the disclosure of the web application s source code, exposing sensitive information such as the database password.
CVE-2024-38657 1 Ivanti 2 Connect Secure, Policy Secure 2025-07-09 4.9 Medium
External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to write arbitrary files.
CVE-2024-38029 1 Microsoft 1 Windows Server 2022 23h2 2025-07-08 7.5 High
Microsoft OpenSSH for Windows Remote Code Execution Vulnerability
CVE-2024-43615 1 Microsoft 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more 2025-07-08 7.1 High
Microsoft OpenSSH for Windows Remote Code Execution Vulnerability
CVE-2024-43581 1 Microsoft 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more 2025-07-08 7.1 High
Microsoft OpenSSH for Windows Remote Code Execution Vulnerability
CVE-2024-33671 1 Veritas 1 Backup Exec 2025-06-30 7.7 High
An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. The Backup Exec Deduplication Multi-threaded Streaming Agent can be leveraged to perform arbitrary file deletion on protected files.
CVE-2024-57394 1 Qianxin 1 Tianqing Endpoint Security Management System 2025-06-23 8.8 High
The quarantine - restore function in Qi-ANXIN Tianqing Endpoint Security Management System v10.0 allows user to restore a malicious file to an arbitrary file path. Attackers can write malicious DLL to system path and perform privilege escalation by leveraging Windows DLL hijacking vulnerabilities.
CVE-2024-0265 1 Oretnom23 1 Clinic Queuing System 2025-06-09 6.3 Medium
A vulnerability was found in SourceCodester Clinic Queuing System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php of the component GET Parameter Handler. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249821 was assigned to this vulnerability.
CVE-2024-55371 1 Wallosapp 1 Wallos 2025-06-03 9.8 Critical
Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an authenticated attacker (being an administrator is not required) to upload malicious files to the server. Once a web shell is installed, the attacker gains the ability to execute arbitrary commands.
CVE-2024-55372 1 Wallosapp 1 Wallos 2025-06-03 9.8 Critical
Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an unauthenticated attacker to upload malicious files to the server. Once a web shell is installed, the attacker gains the ability to execute arbitrary commands.
CVE-2024-20652 1 Microsoft 13 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 10 more 2025-06-03 8.1 High
Windows HTML Platforms Security Feature Bypass Vulnerability
CVE-2020-36772 1 Cloudlinux 1 Cagefs 2025-05-30 4.4 Medium
CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitrary files of certain file formats outside the CageFS environment.
CVE-2023-6618 1 Oretnom23 1 Simple Student Attendance System 2025-05-27 5.5 Medium
A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusion. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247255.
CVE-2021-21343 7 Apache, Debian, Fedoraproject and 4 more 21 Activemq, Jmeter, Debian Linux and 18 more 2025-05-23 5.3 Medium
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in the deletion of a file on the local host. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
CVE-2023-6569 1 H2o 1 H2o 2025-05-22 8.2 High
External Control of File Name or Path in h2oai/h2o-3
CVE-2024-0728 1 Foru Cms Project 1 Foru Cms 2025-05-09 4.7 Medium
A vulnerability classified as problematic was found in ForU CMS up to 2020-06-23. Affected by this vulnerability is an unknown functionality of the file channel.php. The manipulation of the argument c_cmodel leads to file inclusion. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251551.
CVE-2024-26185 1 Microsoft 2 Windows 11 22h2, Windows 11 23h2 2025-05-03 6.5 Medium
Windows Compressed Folder Tampering Vulnerability
CVE-2022-32222 2 Nodejs, Siemens 2 Node.js, Sinec Ins 2025-05-01 5.3 Medium
A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.
CVE-2022-42893 1 Siemens 1 Syngo Dynamics Cardiovascular Imaging And Information System 2025-04-30 7.5 High
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder accessible to the account assigned to the website’s application pool.