- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows -...
CVE-2026-71453
- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This i
#cwe-73
共收录 423 条相关情报。
← 返回所有主题- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63.
CVE-2026-71453
- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This i
An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrite, or...
CVE-2026-97662
An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is ...
CVE-2026-103255
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerabi
n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase
CVE-2026-103255
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerabi
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to ...
CVE-2026-15983
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in al
Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter
CVE-2026-15983
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in al
The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resultin...
CVE-2026-19253
The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in i
The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauth...
CVE-2026-101148
The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, tre
An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations acc...
CVE-2026-102146
An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files wi
Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs a...
CVE-2026-101126
Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission process
Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a...
CVE-2026-85520
Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the
FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionality that allows an ...
CVE-2026-54675
FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound lan
SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to create arbitrary directory trees...
CVE-2026-100638
SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authent
SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the worksp...
CVE-2026-100637
SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authentica
SiYuan before v3.8.4 Path Traversal via setNotebookIcon
CVE-2026-100638
SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authent
SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID
CVE-2026-100637
SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authentica
An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint...
CVE-2026-13248
An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerabil
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x2...
CVE-2026-96656
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The pr
Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherit...
CVE-2026-92164
Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSes