Total
337 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-25759 | 1 Sucms Project | 1 Sucms | 2025-04-09 | N/A | 7.5 HIGH |
| An issue in the component admin_template.php of SUCMS v1.0 allows attackers to execute a directory traversal and arbitrary file deletion via a crafted GET request. | |||||
| CVE-2024-13126 | 1 W3eden | 1 Download Manager | 2025-04-09 | N/A | 4.6 MEDIUM |
| The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of files. | |||||
| CVE-2009-3597 | 1 Digitaldesign Cms Project | 1 Digitaldesign Cms | 2025-04-09 | 5.0 MEDIUM | N/A |
| Digitaldesign CMS 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for autoconfig.dd. | |||||
| CVE-2022-47950 | 2 Debian, Openstack | 2 Debian Linux, Swift | 2025-04-04 | N/A | 6.5 MEDIUM |
| An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed). | |||||
| CVE-2023-4743 | 1 Iteachyou | 1 Dreamer Cms | 2025-04-04 | 2.1 LOW | 3.1 LOW |
| A vulnerability was found in Dreamer CMS up to 4.1.3. It has been classified as problematic. Affected is an unknown function of the file /upload/ueditorConfig?action=config. The manipulation leads to files or directories accessible. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238632. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2023-43856 | 1 Iteachyou | 1 Dreamer Cms | 2025-04-04 | N/A | 7.5 HIGH |
| Dreamer CMS v4.1.3 was discovered to contain an arbitrary file read vulnerability via the component /admin/TemplateController.java. | |||||
| CVE-2005-1835 | 1 Nextweb | 1 Nextweb \(i\)site | 2025-04-03 | 5.0 MEDIUM | N/A |
| NEXTWEB (i)Site stores databases under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to databases/Users.mdb. | |||||
| CVE-2015-4715 | 1 Owncloud | 2 Owncloud, Owncloud Server | 2025-03-31 | 4.0 MEDIUM | 4.9 MEDIUM |
| The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mounted, allows remote administrators of Dropbox.com to read arbitrary files via an @ (at sign) character in unspecified POST values. | |||||
| CVE-2025-25799 | 1 Seacms | 1 Seacms | 2025-03-28 | N/A | 6.0 MEDIUM |
| SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe.php. | |||||
| CVE-2024-29225 | 2025-03-27 | N/A | 4.3 MEDIUM | ||
| WRC-X3200GST3-B v1.25 and earlier, and WRC-G01-W v1.24 and earlier allow a network-adjacent unauthenticated attacker to obtain the configuration file containing sensitive information by sending a specially crafted request. | |||||
| CVE-2025-27147 | 2025-03-27 | N/A | 8.2 HIGH | ||
| The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deployment, VMWare ESX host remote inventory, and data collection (files, Windows registry, WMI). Versions prior to 1.5.0 have an improper access control vulnerability. Version 1.5.0 fixes the vulnerability. | |||||
| CVE-2024-27182 | 1 Apache | 1 Linkis | 2025-03-27 | N/A | 4.9 MEDIUM |
| In Apache Linkis <= 1.5.0, Arbitrary file deletion in Basic management services on A user with an administrator account could delete any file accessible by the Linkis system user . Users are recommended to upgrade to version 1.6.0, which fixes this issue. | |||||
| CVE-2025-2652 | 1 Oretnom23 | 1 Employee And Visitor Gate Pass Logging System | 2025-03-26 | 5.0 MEDIUM | 5.3 MEDIUM |
| A vulnerability has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to exposure of information through directory listing. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. Multiple sub-directories are affected. | |||||
| CVE-2022-44343 | 1 Crmeb | 1 Crmeb | 2025-03-26 | N/A | 7.5 HIGH |
| CRMEB 4.4.4 is vulnerable to Any File download. | |||||
| CVE-2025-2147 | 1 Caishixiong | 1 Modern Farm Digital Integrated Management System | 2025-03-24 | 5.0 MEDIUM | 5.3 MEDIUM |
| A vulnerability was found in Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to files or directories accessible. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2024-40767 | 1 Openstack | 1 Nova | 2025-03-19 | N/A | 6.5 MEDIUM |
| In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498. | |||||
| CVE-2023-41916 | 1 Apache | 1 Linkis | 2025-03-14 | N/A | 6.5 MEDIUM |
| In Apache Linkis =1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will trigger arbitrary file reading. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis = 1.4.0 will be affected. We recommend users upgrade the version of Linkis to version 1.5.0. | |||||
| CVE-2025-22369 | 2025-03-11 | N/A | N/A | ||
| The ReadFile endpoint of the firmware for Mennekes Smart / Premium Chargingpoints can be abused to read arbitrary files from the underlying OS. | |||||
| CVE-2025-25267 | 2025-03-11 | N/A | 6.2 MEDIUM | ||
| A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0010). The affected application does not properly restrict the scope of files accessible to the simulation model. This could allow an unauthorized attacker to compromise the confidentiality of the system. | |||||
| CVE-2025-25266 | 2025-03-11 | N/A | 6.8 MEDIUM | ||
| A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0010). The affected application does not properly restrict access to the file deletion functionality. This could allow an unauthorized attacker to delete files even when access to the system should be prohibited, resulting in potential data loss or unauthorized modification of system files. | |||||