Filtered by CWE-35
Filtered by vendor Subscriptions
Total 121 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-56213 2 Themewinter, Wordpress 2 Eventin, Wordpress 2025-08-11 6.5 Medium
Path Traversal: '.../...//' vulnerability in Themewinter Eventin allows Path Traversal.This issue affects Eventin: from n/a through 4.0.7.
CVE-2025-53417 1 Delta Electronics 1 Diaview 2025-08-05 N/A
DIAView (v4.2.0 and prior) - Directory Traversal Information Disclosure Vulnerability
CVE-2021-1132 1 Cisco 1 Network Services Orchestrator 2025-08-05 5.3 Medium
A vulnerability in the API subsystem and in the web-management interface of Cisco Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to access sensitive data. This vulnerability exists because the web-management interface and certain HTTP-based APIs do not properly validate user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to access sensitive files on the affected system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVE-2020-26073 1 Cisco 1 Catalyst Sd-wan Manager 2025-08-04 7.5 High
A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of directory traversal character sequences within requests to application programmatic interfaces (APIs). An attacker could exploit this vulnerability by sending malicious requests to an API within the affected application. A successful exploit could allow the attacker to conduct directory traversal attacks and gain access to sensitive information including credentials or user tokens.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVE-2025-20320 1 Splunk 3 Splunk, Splunk Cloud Platform, Splunk Enterprise 2025-07-21 6.3 Medium
In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the `User Interface - Views` configuration page that could potentially lead to a denial of service (DoS).The user could cause the DoS by exploiting a path traversal vulnerability that allows for deletion of arbitrary files within a Splunk directory. The vulnerability requires the low-privileged user to phish the administrator-level victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.
CVE-2025-52810 1 Wordpress 1 Wordpress 2025-07-14 8.1 High
Path Traversal vulnerability in TMRW-studio Katerio - Magazine allows PHP Local File Inclusion. This issue affects Katerio - Magazine: from n/a through 1.5.1.
CVE-2025-52811 1 Wordpress 1 Wordpress 2025-07-14 8.1 High
Path Traversal vulnerability in Creanncy Davenport - Versatile Blog and Magazine WordPress Theme allows PHP Local File Inclusion. This issue affects Davenport - Versatile Blog and Magazine WordPress Theme: from n/a through 1.3.
CVE-2025-52805 1 Wordpress 1 Wordpress 2025-07-14 7.5 High
Path Traversal vulnerability in VaultDweller Leyka allows PHP Local File Inclusion. This issue affects Leyka: from n/a through 3.31.9.
CVE-2024-56049 1 Wordpress 1 Wordpress 2025-07-14 8.5 High
Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS allows Path Traversal.This issue affects WPLMS: from n/a before 1.9.9.5.2.
CVE-2025-46441 1 Wordpress 1 Wordpress 2025-07-13 5.3 Medium
Path Traversal: '.../...//' vulnerability in ctltwp Section Widget allows Path Traversal.This issue affects Section Widget: from n/a through 3.3.1.
CVE-2024-56045 1 Wordpress 1 Wordpress 2025-07-13 9.3 Critical
Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS allows Path Traversal.This issue affects WPLMS: from n/a before 1.9.9.5.
CVE-2025-26353 1 Q-free 1 Maxtime 2025-07-13 4.9 Medium
A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.
CVE-2024-52447 1 Wordpress 1 Wordpress 2025-07-13 8.6 High
Path Traversal: '.../...//' vulnerability in Corporate Zen Contact Page With Google Map allows Path Traversal.This issue affects Contact Page With Google Map: from n/a through 1.6.1.
CVE-2024-56214 1 Wordpress 1 Wordpress 2025-07-13 8.3 High
Path Traversal: '.../...//' vulnerability in DeluxeThemes Userpro allows Path Traversal.This issue affects Userpro: from n/a through 5.1.9.
CVE-2024-56055 1 Wordpress 1 Wordpress 2025-07-13 8.5 High
Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS allows Path Traversal.This issue affects WPLMS: from n/a before 1.9.9.5.2.
CVE-2025-25122 1 Wordpress 1 Wordpress 2025-07-12 8.1 High
Path Traversal vulnerability in NotFound WizShop allows PHP Local File Inclusion. This issue affects WizShop: from n/a through 3.0.2.
CVE-2025-22786 2 Elementinvader, Wordpress 2 Elementinvader Addons For Elementor, Wordpress 2025-07-12 7.5 High
Path Traversal vulnerability in ElementInvader ElementInvader Addons for Elementor allows PHP Local File Inclusion.This issue affects ElementInvader Addons for Elementor: from n/a through 1.2.6.
CVE-2025-26351 1 Q-free 1 Maxtime 2025-07-12 4.9 Medium
A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.
CVE-2025-26352 1 Q-free 1 Maxtime 2025-07-12 6.5 Medium
A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests.
CVE-2025-26354 1 Q-free 1 Maxtime 2025-07-12 7.2 High
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests.