Total
143 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-4799 | 1 Wp-downloadmanager Project | 1 Wp-downloadmanager | 2026-06-17 | N/A | 7.2 HIGH |
| The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file deletion due to lack of restriction on the directory a file can be deleted from in all versions up to, and including, 1.68.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability can be paired with CVE-2025-4798 to delete any file within the WordPress root directory. | |||||
| CVE-2025-46822 | 2026-06-17 | N/A | N/A | ||
| OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized access to sensitive internal files. Commit c835c6f7799eacada4c0fc77e0816f250af01ad2 contains a patch for the issue. | |||||
| CVE-2025-36574 | 1 Dell | 1 Wyse Management Suite | 2026-06-17 | N/A | 8.2 HIGH |
| Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Absolute Path Traversal vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Unauthorized access. | |||||
| CVE-2025-36357 | 1 Ibm | 2 Planning Analytics Local, Planning Analytics Workspace | 2026-06-17 | N/A | 8.0 HIGH |
| IBM Planning Analytics Local 2.1.0 through 2.1.14 could allow a remote authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing absolute path sequences to view, read, or write arbitrary files on the system. | |||||
| CVE-2025-34392 | 1 Barracuda | 1 Rmm | 2026-06-17 | N/A | 9.8 CRITICAL |
| Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload. | |||||
| CVE-2025-15237 | 1 Quantatw | 1 Qoca Aim | 2026-06-17 | N/A | 4.3 MEDIUM |
| QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder names under the specified path by exploiting an Absolute Path Traversal vulnerability. | |||||
| CVE-2025-15236 | 1 Quantatw | 1 Qoca Aim | 2026-06-17 | N/A | 4.3 MEDIUM |
| QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder names under the specified path by exploiting an Absolute Path Traversal vulnerability. | |||||
| CVE-2025-15227 | 1 Welltend | 1 Bpmflowwebkit | 2026-06-17 | N/A | 7.5 HIGH |
| BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Traversal to download arbitrary system files. | |||||
| CVE-2025-14848 | 1 Advantech | 1 Webaccess\/scada | 2026-06-17 | N/A | 4.3 MEDIUM |
| Advantech WebAccess/SCADA is vulnerable to absolute directory traversal, which may allow an attacker to determine the existence of arbitrary files. | |||||
| CVE-2025-14253 | 1 Gss | 1 Vitalsesp | 2026-06-17 | N/A | 4.9 MEDIUM |
| Vitals ESP developed by Galaxy Software Services has an Arbitrary File Read vulnerability, allowing privileged remote attackers to exploit Absolute Path Traversal to download arbitrary system files. | |||||
| CVE-2025-13283 | 1 Cht | 1 Tenderdoctransfer | 2026-06-17 | N/A | 7.1 HIGH |
| TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Copy and Paste vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains an Absolute Path Traversal vulnerability. Attackers can copy arbitrary files on the user's system and paste them into any path, which poses a potential risk of information leakage or could consume hard drive space by copying files in large volumes. | |||||
| CVE-2025-13282 | 1 Cht | 1 Tenderdoctransfer | 2026-06-17 | N/A | 8.1 HIGH |
| TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains an Absolute Path Traversal vulnerability, allowing attackers to delete arbitrary files on the user's system. | |||||
| CVE-2025-0851 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary locations. | |||||
| CVE-2025-0001 | 2026-06-17 | N/A | 6.5 MEDIUM | ||
| Abacus ERP is versions older than 2024.210.16036, 2023.205.15833, 2022.105.15542 are affected by an authenticated arbitrary file read vulnerability. | |||||
| CVE-2024-9924 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| The fix for CVE-2024-26261 was incomplete, and and the specific package for OAKlouds from Hgiga remains at risk. Unauthenticated remote attackers still can download arbitrary system files, which may be deleted subsequently . | |||||
| CVE-2024-8778 | 1 Syscomgo | 1 Omflow | 2026-06-17 | N/A | 6.5 MEDIUM |
| OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular privileges to read arbitrary system files. | |||||
| CVE-2024-8501 | 1 Modelscope | 1 Agentscope | 2026-06-17 | N/A | 8.8 HIGH |
| An arbitrary file download vulnerability exists in the rpc_agent_client component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpc_agent's host by exploiting the download_file method. This can lead to unauthorized access to sensitive information, including configuration files, credentials, and potentially system files, which may facilitate further exploitation such as privilege escalation or lateral movement within the network. | |||||
| CVE-2024-8497 | 2026-06-17 | N/A | 7.5 HIGH | ||
| Franklin Fueling Systems TS-550 EVO versions prior to 2.26.4.8967 possess a file that can be read arbitrarily that could allow an attacker obtain administrator credentials. | |||||
| CVE-2024-7323 | 1 Digiwin | 1 Easyflow .net | 2026-06-17 | N/A | 6.5 MEDIUM |
| Digiwin EasyFlow .NET lacks proper access control for specific functionality, and the functionality do not adequately filter user input. A remote attacker with regular privilege can exploit this vulnerability to download arbitrary files from the remote server . | |||||
| CVE-2024-6854 | 1 H2o | 1 H2o | 2026-06-17 | N/A | 7.1 HIGH |
| In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in the server's file structure, thereby overwriting it. This vulnerability can be exploited to overwrite any file on the target server with a trained model file, although the content of the overwrite is not controllable by the attacker. | |||||