Monthly
Path traversal in the Vvveb CMS backup controller lets an administrator-supplied 'file' GET parameter be concatenated onto the backup directory path without sanitization in the nextRestore() and nextBackup() actions, allowing arbitrary server-side file reads (and SQL execution of the read content) and arbitrary-path writes of database dump data with a forced .sql suffix. All installations of Vvveb 1.0.8.6 and prior are affected by default; exploitation requires a valid authenticated administrator session (CVSS PR:H), so this is an access-gated issue rather than a drive-by threat. A public PoC reference exists in the GitHub advisory (curl requests against nextRestore); it is not verified as working exploit code, and no active exploitation has been confirmed (not in CISA KEV). Vendor-released fix: commit aa29cb0, shipped in version 1.0.8.7.
Unauthenticated path traversal in the Super Forms - Drag & Drop Form Builder plugin for WordPress (all versions up to and including 6.3.316) allows remote attackers to read the contents of arbitrary files on the hosting server through the plugin's parse_request handling of form file uploads. In the default configuration the optional 'file_upload_auth' setting is empty, so no credentials are needed, although the vulnerable code path is only reachable when a form with the file upload feature is enabled on the site. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV entry); the practical impact is information disclosure of sensitive files such as configuration and credential material rather than modification or denial of service, and the supplied severity signals are internally inconsistent (the vendor score of 9.1 asserts integrity and availability impact while our assessment finds confidentiality-only impact).
Path traversal in Splunk Enterprise's lookup configuration endpoint allows any authenticated low-privileged user - without admin or power roles - to move arbitrary files readable by the Splunk service account into a user-controlled lookup table on the search head. Affected versions span four active release trains: 10.4.x below 10.4.2, 10.2.x below 10.2.6, 10.0.x below 10.0.9, and 9.4.x below 9.4.14. With a CVSS score of 8.8 and no special configuration required beyond a standard Splunk account, successful exploitation yields full confidentiality, integrity, and availability impact; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Path traversal in Siemens SINEC INS versions prior to V1.0 SP2 Update 6 exposes arbitrary file system locations via the SFTP directory listing endpoint. An authenticated low-privileged network attacker can send a crafted path to GET /api/sftp/uploadFiles to read files outside the intended directory scope, resulting in unauthorized disclosure of file system contents. No active exploitation or public proof-of-concept has been identified at time of analysis; the impact is limited to confidentiality with no integrity or availability consequence.
Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 allows unsafe font upload for skins. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in Delinea Centrify PAS v. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in Delinea Centrify PAS v. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations (with. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Directory Traversal vulnerability in lsgwr spring boot online exam v.0.9 allows an attacker to execute arbitrary code via the FileTransUtil.java component. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105 allows attackers to delete arbitrary files via crafted GET request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Path traversal in the Vvveb CMS backup controller lets an administrator-supplied 'file' GET parameter be concatenated onto the backup directory path without sanitization in the nextRestore() and nextBackup() actions, allowing arbitrary server-side file reads (and SQL execution of the read content) and arbitrary-path writes of database dump data with a forced .sql suffix. All installations of Vvveb 1.0.8.6 and prior are affected by default; exploitation requires a valid authenticated administrator session (CVSS PR:H), so this is an access-gated issue rather than a drive-by threat. A public PoC reference exists in the GitHub advisory (curl requests against nextRestore); it is not verified as working exploit code, and no active exploitation has been confirmed (not in CISA KEV). Vendor-released fix: commit aa29cb0, shipped in version 1.0.8.7.
Unauthenticated path traversal in the Super Forms - Drag & Drop Form Builder plugin for WordPress (all versions up to and including 6.3.316) allows remote attackers to read the contents of arbitrary files on the hosting server through the plugin's parse_request handling of form file uploads. In the default configuration the optional 'file_upload_auth' setting is empty, so no credentials are needed, although the vulnerable code path is only reachable when a form with the file upload feature is enabled on the site. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV entry); the practical impact is information disclosure of sensitive files such as configuration and credential material rather than modification or denial of service, and the supplied severity signals are internally inconsistent (the vendor score of 9.1 asserts integrity and availability impact while our assessment finds confidentiality-only impact).
Path traversal in Splunk Enterprise's lookup configuration endpoint allows any authenticated low-privileged user - without admin or power roles - to move arbitrary files readable by the Splunk service account into a user-controlled lookup table on the search head. Affected versions span four active release trains: 10.4.x below 10.4.2, 10.2.x below 10.2.6, 10.0.x below 10.0.9, and 9.4.x below 9.4.14. With a CVSS score of 8.8 and no special configuration required beyond a standard Splunk account, successful exploitation yields full confidentiality, integrity, and availability impact; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Path traversal in Siemens SINEC INS versions prior to V1.0 SP2 Update 6 exposes arbitrary file system locations via the SFTP directory listing endpoint. An authenticated low-privileged network attacker can send a crafted path to GET /api/sftp/uploadFiles to read files outside the intended directory scope, resulting in unauthorized disclosure of file system contents. No active exploitation or public proof-of-concept has been identified at time of analysis; the impact is limited to confidentiality with no integrity or availability consequence.
Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 allows unsafe font upload for skins. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in Delinea Centrify PAS v. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in Delinea Centrify PAS v. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations (with. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Directory Traversal vulnerability in lsgwr spring boot online exam v.0.9 allows an attacker to execute arbitrary code via the FileTransUtil.java component. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105 allows attackers to delete arbitrary files via crafted GET request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.