Filtered by CWE-73
Filtered by vendor Subscriptions
Total 176 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-10672 1 Themeisle 1 Multiple Page Generator 2024-11-14 2.7 Low
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the mpg_upsert_project_source_block() function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with editor-level access and above, to delete limited files on the server.
CVE-2023-5816 1 Bowo 1 Code Explorer 2024-11-07 4.9 Medium
The Code Explorer plugin for WordPress is vulnerable to arbitrary external file reading in all versions up to, and including, 1.4.5. This is due to the fact that the plugin does not restrict accessing files to those outside of the WordPress instance, though the intention of the plugin is to only access WordPress related files. This makes it possible for authenticated attackers, with administrator-level access, to read files outside of the WordPress instance.
CVE-2024-5823 1 Gaizhenbiao 1 Chuanhuchatgpt 2024-10-31 9.1 Critical
A file overwrite vulnerability exists in gaizhenbiao/chuanhuchatgpt versions <= 20240410. This vulnerability allows an attacker to gain unauthorized access to overwrite critical configuration files within the system. Exploiting this vulnerability can lead to unauthorized changes in system behavior or security settings. Additionally, tampering with these configuration files can result in a denial of service (DoS) condition, disrupting normal system operation.
CVE-2024-38173 1 Microsoft 4 365 Apps, Office, Office Long Term Servicing Channel and 1 more 2024-10-16 6.7 Medium
Microsoft Outlook Remote Code Execution Vulnerability
CVE-2024-38165 1 Microsoft 4 Windows 11 22h2, Windows 11 22h2, Windows 11 23h2 and 1 more 2024-10-16 6.5 Medium
Windows Compressed Folder Tampering Vulnerability
CVE-2024-38040 1 Esri 1 Portal For Arcgis 2024-10-15 7.5 High
There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2. 11.1, 11.0 and 10.9.1 that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files.
CVE-2024-9142 1 Olgu Computer Systems 1 E-belediye 2024-10-14 9.8 Critical
External Control of File Name or Path, : Incorrect Permission Assignment for Critical Resource vulnerability in Olgu Computer Systems e-Belediye allows Manipulating Web Input to File System Calls.This issue affects e-Belediye: before 2.0.642.
CVE-2024-9575 1 Rami.io Gmbh 1 Pretiix Widget Wordpress Plugin 2024-10-14 8.1 High
Local File Inclusion vulnerability in pretix Widget WordPress plugin pretix-widget on Windows allows PHP Local File Inclusion. This issue affects pretix Widget WordPress plugin: from 1.0.0 through 1.0.5.
CVE-2024-9275 1 Jeanmarc77 1 123solar 2024-09-30 6.3 Medium
A vulnerability was found in jeanmarc77 123solar up to 1.8.4.5. It has been rated as critical. This issue affects some unknown processing of the file /admin/admin_invt2.php. The manipulation of the argument PROTOCOLx leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-21545 1 Proxmox 2 Mail Gateway, Virtual Environment 2024-09-26 8.2 High
Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization. Insufficient safeguards against malicious API response values allow authenticated attackers with 'Sys.Audit' or 'VM.Monitor' privileges to download arbitrary host files via the API. When handling the result from a request handler before returning it to the user, the handle_api2_request function will check for the ‘download’ or ‘data’->’download’ objects inside the request handler call response object. If present, handle_api2_request will read a local file defined by this object and return it to the user. Two endpoints were identified which can control the object returned by a request handler sufficiently that the ’download’ object is defined and user controlled. This results in arbitrary file read. The privileges of this file read can result in full compromise of the system by various impacts such as disclosing sensitive files allowing for privileged session forgery.
CVE-2024-7626 1 Wpdelicious 2 Wp Delicious, Wpdelicious 2024-09-25 8.1 High
The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file movement and reading due to insufficient file path validation in the save_edit_profile_details() function in all versions up to, and including, 1.6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php). This can also lead to the reading of arbitrary files that may contain sensitive information like wp-config.php.
CVE-2024-7744 1 Progress 1 Ws Ftp Server 2024-09-04 6.5 Medium
In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Web Transfer Module allows File Discovery, Probe System Files, User-Controlled Filename, Path Traversal.   An authenticated file download flaw has been identified where a user can craft an API call that allows them to download a file from an arbitrary folder on the drive where that user host's root folder is located (by default this is C:)
CVE-2024-7911 2 Oretnom23, Sourcecodester 2 Simple Online Bidding System, Simple Online Bidding System 2024-08-19 6.3 Medium
A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of the file /simple-online-bidding-system/bidding/index.php. The manipulation of the argument page leads to file inclusion. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-7497 2 Angeljudesuarez, Itsourcecode 2 Airline Reservation System, Airline Reservation System 2024-08-19 6.3 Medium
A vulnerability was found in itsourcecode Airline Reservation System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/index.php. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273623.
CVE-2024-7496 2 Angeljudesuarez, Itsourcecode 2 Airline Reservation System, Airline Reservation System 2024-08-19 6.3 Medium
A vulnerability has been found in itsourcecode Airline Reservation System 1.0 and classified as critical. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument page leads to file inclusion. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273622 is the identifier assigned to this vulnerability.
CVE-2015-5196 1 Redhat 1 Enterprise Linux 2023-11-07 N/A
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-7703. Reason: This candidate is a reservation duplicate of CVE-2015-7703. Notes: All CVE users should reference CVE-2015-7703 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.