#cwe-73

共收录 423 条相关情报。

← 返回所有主题

漏洞预警2026-08-28 发布INFO

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and ...

CVE-2026-12513

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly saniti

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-08-27 发布INFO

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and ...

CVE-2026-53580

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-downlo

历史摘要 · 未重新核验 · NVD

#cve #cwe-73 #cwe-400 #cwe-552

安全公告2026-08-27 发布INFO

Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature

CVE-2026-53580

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-downlo

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-400 #cwe-552 #cwe-73

漏洞预警2026-08-27 发布HIGH

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attac...

CVE-2026-81726

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by us

来源摘录 · NVD

#cve #cwe-73

漏洞预警2026-08-27 发布INFO

In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, ...

CVE-2026-79653

In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-73

安全公告2026-08-27 发布INFO

NLTK through 3.10.3 Path Traversal via Model-Artifact APIs

CVE-2026-81726

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by us

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-73

安全公告2026-08-27 发布INFO

CVE-2026-79653

In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22 #cwe-73

漏洞预警2026-08-27 发布INFO

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file pat...

CVE-2026-77016

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate prof

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-08-26 发布HIGH

The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted,...

CVE-2026-77693

该漏洞存在于 Order Tip for WooCommerce WordPress 插件 1.6.0 之前的版本中。插件在处理文件删除的请求时，既没有检查发起请求用户的权限能力，也没有限制可被删除的路径范围。因此，凡是拥有 Shop Ma

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-08-25 发布INFO

Typebot is an open-source chatbot builder. In self-hosted versions prior to 3.18.0, the server-side Send Email integration block allows arbitrary reading of local files on the s...

CVE-2026-62865

Typebot is an open-source chatbot builder. In self-hosted versions prior to 3.18.0, the server-side Send Email integrati

历史摘要 · 未重新核验 · NVD

#cve #cwe-73 #cwe-200

漏洞预警2026-08-25 发布INFO

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear...

CVE-2026-55609

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

安全公告2026-08-25 发布INFO

consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write

CVE-2026-55609

### Impact An arbitrary file write vulnerability (CWE-73, External Control of File Name or Path) exists in the `consciou

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-73 #severity:high

漏洞预警2026-08-25 发布INFO

NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attacke...

CVE-2026-79674

NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attack

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-08-25 发布INFO

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized user_id into self.user_path. A caller supplying ../ or pat...

CVE-2026-55527

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized u

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-73

漏洞预警2026-08-25 发布INFO

The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend ...

CVE-2026-77139

The extension fails to validate a client-supplied template element key before using it to build file paths for saving an

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-73

漏洞预警2026-08-25 发布INFO

GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard. Attackers...

CVE-2026-78679

GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional refere

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-08-25 发布INFO

GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [includ...

CVE-2026-78675

GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local f

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-08-25 发布INFO

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attack...

CVE-2026-56705

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated a

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-08-25 发布INFO

Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated u...

CVE-2026-34967

Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in th

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

安全公告2026-08-24 发布INFO

3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation

CVE-2026-55477

# Summary An authenticated administrator can abuse the database import functionality to achieve arbitrary file write on

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-20 #cwe-73 #severity:high