Filtered by CWE-22
Filtered by vendor Subscriptions
Total 9119 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-25183 2 Givanz, Vvveb 2 Vvvebjs, Vvvebjs 2026-01-05 7.5 High
givanz VvvebJs 1.7.2 is vulnerable to Directory Traversal via scan.php.
CVE-2025-14420 1 Pdfforge 1 Pdf Architect 2026-01-03 N/A
pdfforge PDF Architect CBZ File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CBZ files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27514.
CVE-2025-65815 2 Ab Technology, Uniteddevelopers 2 Document Reader, Document Reader\ 2026-01-03 6.5 Medium
A lack of security checks in the file import process of AB TECHNOLOGY Document Reader: PDF, DOC, PPT v65.0 allows attackers to execute a directory traversal.
CVE-2023-47467 1 Jeecg 1 Jeecg Boot 2026-01-02 6.5 Medium
Directory Traversal vulnerability in jeecg-boot v.3.6.0 allows a remote privileged attacker to obtain sensitive information via the file directory structure.
CVE-2025-67442 1 Eve-ng 1 Eve-ng 2026-01-02 7.6 High
EVE-NG 6.4.0-13-PRO is vulnerable to Directory Traversal. The /api/export interface allows authenticated users to export lab files. This interface lacks effective input validation and filtering when processing file path parameters submitted by users.
CVE-2025-68279 1 Weblate 1 Weblate 2026-01-02 7.7 High
Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to read arbitrary files from the server file system using crafted symbolic links in the repository. Version 5.15.1 fixes the issue.
CVE-2024-42718 1 Croogo 1 Croogo 2026-01-01 6.5 Medium
A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter.
CVE-2025-15225 1 Sun.net 1 Wmpro 2025-12-31 7.5 High
WMPro developed by Sunnet has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to read arbitrary system files.
CVE-2025-15227 1 Welltend 1 Bpmflowwebkit 2025-12-31 7.5 High
BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Traversal to download arbitrary system files.
CVE-2025-14850 1 Advantech 2 Webaccess/scada, Webaccess\/scada 2025-12-31 8.1 High
Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to delete arbitrary files.
CVE-2020-12103 1 Prasathmani 1 Tiny File Manager 2025-12-31 7.7 High
In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create backup copies of files (with .bak extension) outside the scope in the same directory in which they are stored.
CVE-2021-45010 1 Prasathmani 1 Tiny File Manager 2025-12-31 8.8 High
A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution.
CVE-2022-1000 1 Prasathmani 1 Tiny File Manager 2025-12-31 9.8 Critical
Path Traversal in GitHub repository prasathmani/tinyfilemanager prior to 2.4.7.
CVE-2020-12102 1 Prasathmani 1 Tiny File Manager 2025-12-31 7.7 High
In Tiny File Manager 2.4.1, there is a Path Traversal vulnerability in the ajax recursive directory listing functionality. This allows authenticated users to enumerate directories and files on the filesystem (outside of the application scope).
CVE-2021-40964 1 Prasathmani 1 Tiny File Manager 2025-12-31 6.5 Medium
A Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload a file (with Admin credentials or with the CSRF vulnerability) with the "fullpath" parameter containing path traversal strings (../ and ..\) in order to escape the server's intended working directory and write malicious files onto any directory on the computer.
CVE-2025-15138 1 Prasathmani 1 Tiny File Manager 2025-12-31 4.7 Medium
A flaw has been found in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php. This manipulation of the argument fullpath causes path traversal. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-67653 1 Advantech 2 Webaccess/scada, Webaccess\/scada 2025-12-31 4.3 Medium
Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to determine the existence of arbitrary files.
CVE-2025-32950 1 Haulmont 1 Jmix Framework 2025-12-31 6.5 Medium
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, attackers could manipulate the FileRef parameter to access files on the system where the Jmix application is deployed, provided the application server has the necessary permissions. This can be accomplished either by modifying the FileRef directly in the database or by supplying a harmful value in the fileRef parameter of the `/files` endpoint of the generic REST API. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.
CVE-2025-24963 1 Vitest.dev 1 Vitest 2025-12-31 5.9 Medium
Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host: true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-24786 1 Clidey 1 Whodb 2025-12-31 10 Critical
WhoDB is an open source database management tool. While the application only displays Sqlite3 databases present in the directory `/db`, there is no path traversal prevention in place. This allows an unauthenticated attacker to open any Sqlite3 database present on the host machine that the application is running on. Affected versions of WhoDB allow users to connect to Sqlite3 databases. By default, the databases must be present in `/db/` (or alternatively `./tmp/` if development mode is enabled). If no databases are present in the default directory, the UI indicates that the user is unable to open any databases. The database file is an user-controlled value. This value is used in `.Join()` with the default directory, in order to get the full path of the database file to open. No checks are performed whether the database file that is eventually opened actually resides in the default directory `/db`. This allows an attacker to use path traversal (`../../`) in order to open any Sqlite3 database present on the system. This issue has been addressed in version 0.45.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.