LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated...
CVE-2026-105125
LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON fi
#cwe-22
共收录 2611 条相关情报。
← 返回所有主题LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the {lang} route segment. On Windows ...
CVE-2026-105125
LaraDashboard 是一个基于 Laravel 框架的后台仪表盘组件。根据 NVD 元数据，该组件在 1.4.8 之前的版本中存在一处路径穿越（Path Traversal）漏洞。漏洞的触发点位于应用路由中的 {lang} 路径段：
A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function...
CVE-2026-104983
A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function g_file_get_child of the file
A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function g_file_get_child of the file shell/ev-window.c of the component PDF Attachment Saving ...
CVE-2026-104983
A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function g_file_get_child of the file
Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal
CVE-2026-104983
A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function g_file_get_child of the file
A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function...
CVE-2026-104982
A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup_document_content_list/g_s
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary...
CVE-2026-87115
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insuf
A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup_document_content_list/g_strdup_printf of the file backend/epub/epub-document.c of ...
CVE-2026-104982
A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup_document_content_list/g_s
Linux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversal
CVE-2026-104982
A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup_document_content_list/g_s
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in a...
CVE-2026-87115
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insuf
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths...
CVE-2026-85015
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archive
The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its...
CVE-2026-94238
The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will rea
The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when...
CVE-2026-103293
The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a
The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress pl...
CVE-2026-94238
The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will rea
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users wi...
CVE-2026-85015
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archive
The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path ...
CVE-2026-103293
The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a
Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows...
CVE-2026-104478
Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users
Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup...
CVE-2026-104478
Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users
SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)
# Security Advisory — SiYuan MCP `asset.upload` Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass) | Field
Vibe-Trading file-read tools expose arbitrary server-readable files
### Summary: 2 findings — `safe_user_path()` accepts any path under `Path.home()` or `Path.cwd()`, which inside the shi