Total
10261 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-5147 | 1 Wpzoom | 1 Wpzoom Elementor Addons | 2026-06-17 | N/A | 9.8 CRITICAL |
| The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.37 via the 'grid_style' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. | |||||
| CVE-2024-5040 | 2026-06-17 | N/A | 7.8 HIGH | ||
| There are multiple ways in LCDS LAquis SCADA for an attacker to access locations outside of their own directory. | |||||
| CVE-2024-5019 | 1 Progress | 1 Whatsup Gold | 2026-06-17 | N/A | 5.3 MEDIUM |
| In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Arbitrary File Read issue exists in Wug.UI.Areas.Wug.Controllers.SessionController.CachedCSS. This vulnerability allows reading of any file with iisapppool\NmConsole privileges. | |||||
| CVE-2024-5018 | 1 Progress | 1 Whatsup Gold | 2026-06-17 | N/A | 5.3 MEDIUM |
| In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Path Traversal vulnerability exists Wug.UI.Areas.Wug.Controllers.SessionController.LoadNMScript. This allows allows reading of any file from the applications web-root directory . | |||||
| CVE-2024-5017 | 1 Progress | 1 Whatsup Gold | 2026-06-17 | N/A | 6.5 MEDIUM |
| In WhatsUp Gold versions released before 2023.1.3, a path traversal vulnerability exists. A specially crafted unauthenticated HTTP request to AppProfileImport can lead can lead to information disclosure. | |||||
| CVE-2024-58312 | 1 Xbtitfm | 1 Xbtitfm | 2026-06-17 | N/A | 7.5 HIGH |
| xbtitFM 4.1.18 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulating URL parameters. Attackers can exploit directory traversal techniques to read critical system files like using encoded path traversal characters in HTTP requests. | |||||
| CVE-2024-58310 | 2026-06-17 | N/A | N/A | ||
| APC Network Management Card 4 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulating URL parameters. Attackers can exploit directory traversal techniques to read critical system files like /etc/passwd by using encoded path traversal characters in HTTP requests. | |||||
| CVE-2024-57784 | 2026-06-17 | N/A | 5.5 MEDIUM | ||
| An issue in the component /php/script_uploads.php of Zenitel AlphaWeb XE v11.2.3.10 allows attackers to execute a directory traversal. | |||||
| CVE-2024-57777 | 1 Lanproxy Project | 1 Lanproxy | 2026-06-17 | N/A | 5.1 MEDIUM |
| Directory Traversal vulnerability in Ianproxy v.0.1 and before allows a remote attacker to obtain sensitive information | |||||
| CVE-2024-57728 | 1 Simple-help | 1 Simplehelp | 2026-06-17 | N/A | 7.2 HIGH |
| SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user. | |||||
| CVE-2024-57669 | 2026-06-17 | N/A | 7.5 HIGH | ||
| Directory Traversal vulnerability in Zrlog backup-sql-file.jar v.3.0.31 allows a remote attacker to obtain sensitive information via the BackupController.java file. | |||||
| CVE-2024-57549 | 1 Cmsimple | 1 Cmsimple | 2026-06-17 | N/A | 7.5 HIGH |
| CMSimple 5.16 allows the user to read cms source code through manipulation of the file name in the file parameter of a GET request. | |||||
| CVE-2024-57451 | 1 1000mz | 1 Chestnutcms | 2026-06-17 | N/A | 7.5 HIGH |
| ChestnutCMS <=1.5.0 has a directory traversal vulnerability in contentcore.controller.FileController#getFileList, which allows attackers to view any directory. | |||||
| CVE-2024-57248 | 1 Gleamtech | 1 Filevista | 2026-06-17 | N/A | 6.3 MEDIUM |
| Directory Traversal in File Upload in Gleamtech FileVista 9.2.0.0 allows remote attackers to achieve Code Execution, Information Disclosure, and Escalation of Privileges via injecting malicious payloads in HTTP requests to manipulate file paths, bypass access controls, and upload malicious files. | |||||
| CVE-2024-57189 | 1 Erxes | 1 Erxes | 2026-06-17 | N/A | 5.4 MEDIUM |
| In Erxes <1.6.2, an authenticated attacker can write to arbitrary files on the system using a Path Traversal vulnerability in the importHistoriesCreate GraphQL mutation handler. | |||||
| CVE-2024-57186 | 1 Erxes | 1 Erxes | 2026-06-17 | N/A | 5.4 MEDIUM |
| In Erxes <1.6.2, an unauthenticated attacker can read arbitrary files from the system using a Path Traversal vulnerability in the /read-file endpoint handler. | |||||
| CVE-2024-57170 | 1 Soplanning | 1 Soplanning | 2026-06-17 | N/A | 6.5 MEDIUM |
| SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php. The "fichier_to_delete" parameter allows authenticated attackers to specify file paths containing directory traversal sequences (e.g., ../). This vulnerability enables attackers to delete arbitrary files outside the intended upload directory, potentially leading to denial of service or disruption of application functionality. | |||||
| CVE-2024-56514 | 2026-06-17 | N/A | N/A | ||
| Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, both in karmadactl and karmada-operator, it is possible to supply a filesystem path, or an HTTP(s) URL to retrieve the custom resource definitions(CRDs) needed by Karmada. The CRDs are downloaded as a gzipped tarfile and are vulnerable to a TarSlip vulnerability. An attacker able to supply a malicious CRD file into a Karmada initialization could write arbitrary files in arbitrary paths of the filesystem. From Karmada version 1.12.0, when processing custom CRDs files, CRDs archive verification is utilized to enhance file system robustness. A workaround is available. Someone who needs to set flag `--crd` to customize the CRD files required for Karmada initialization when using `karmadactl init` to set up Karmada can manually inspect the CRD files to check whether they contain sequences such as `../` that would alter file paths, to determine if they potentially include malicious files. When using karmada-operator to set up Karmada, one must upgrade one's karmada-operator to one of the fixed versions. | |||||
| CVE-2024-56509 | 2026-06-17 | N/A | 8.6 HIGH | ||
| changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Improper input validation in the application can allow attackers to perform local file read (LFR) or path traversal attacks. These vulnerabilities occur when user input is used to construct file paths without adequate sanitization or validation. For example, using file:../../../etc/passwd or file: ///etc/passwd can bypass weak validations and allow unauthorized access to sensitive files. Even though this has been addressed in previous patch, it is still insufficient. This vulnerability is fixed in 0.48.05. | |||||
| CVE-2024-56477 | 1 Ibm | 1 Power Hardware Management Console | 2026-06-17 | N/A | 6.5 MEDIUM |
| IBM Power Hardware Management Console V10.3.1050.0 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. | |||||