CWE-22 · Path Traversal (page 27)
Page 27 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48940 | High | 7.2 | 2025-06-02 | MyBB is free and open source forum software. Prior to version 1.8.39, the upgrade component does not validate user input properly, which allows attackers to pe… |
CVE-2025-37095 | Critical | 9.8 | 2025-06-02 | A directory traversal information disclosure vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37094 | Medium | 5.5 | 2025-06-02 | A directory traversal arbitrary file deletion vulnerability exists in HPE StoreOnce Software. |
CVE-2025-48957 | High | 7.5 | 2025-06-02 | AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to inform… |
CVE-2025-33004 | Medium | 6.5 | 2025-06-01 | IBM Planning Analytics Local 2.0 and 2.1 could allow a privileged user to delete files from directories due to improper pathname restriction. |
CVE-2025-5385 | Medium | 6.3 | 2025-05-31 | A vulnerability was found in JeeWMS up to 20250504. It has been declared as critical. This vulnerability affects the function doAdd of the file /cgformTemplate… |
CVE-2025-5381 | Low | 2.7 | 2025-05-31 | A vulnerability, which was classified as problematic, was found in Yifang CMS up to 2.0.2. Affected is the function downloadFile of the file /api/File/download… |
CVE-2025-5380 | Medium | 6.3 | 2025-05-31 | A vulnerability, which was classified as critical, has been found in ashinigit 天青一白 XueShengZhuSu 学生住宿管理系统 up to 4d3f0ada0e71482c1e51fd5f5615e5a3d8bcbfbb. This… |
CVE-2025-4857 | High | 7.2 | 2025-05-31 | The Newsletters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.9.9 via the 'file' parameter. This makes i… |
CVE-2025-47952 | Critical | 9.1 | 2025-05-30 | Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Prior to versions 2.11.25 and 3.4.1, there is a potential vulnerability in Traefik man… |
CVE-2025-5328 | Medium | 5.4 | 2025-05-29 | A vulnerability was found in chshcms mccms 2.7. It has been declared as critical. This vulnerability affects the function restore_del of the file /sys/apps/con… |
CVE-2024-51453 | Medium | 4.3 | 2025-05-28 | IBM Sterling Secure Proxy 6.2.0.0 through 6.2.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially craft… |
CVE-2025-48370 | | 2025-05-27 | auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFact… | |
CVE-2025-48744 | Medium | 6.4 | 2025-05-27 | In SIGB PMB before 8.0.1.2, attackers can achieve Local File Inclusion and remote code execution. |
CVE-2025-5161 | Medium | 4.3 | 2025-05-26 | A vulnerability classified as problematic was found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected by this vulnerability is the function operationDaily… |
CVE-2025-5160 | Medium | 4.3 | 2025-05-26 | A vulnerability classified as problematic has been found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected is the function Download of the file /packetCap… |
CVE-2025-5159 | Medium | 4.3 | 2025-05-26 | A vulnerability was found in H3C SecCenter SMP-E1114P02 up to 20250513. It has been rated as problematic. This issue affects the function Download of the file… |
CVE-2025-5158 | Medium | 4.3 | 2025-05-25 | A vulnerability was found in H3C SecCenter SMP-E1114P02 up to 20250513. It has been declared as problematic. This vulnerability affects the function downloadSo… |
CVE-2025-5157 | Medium | 4.3 | 2025-05-25 | A vulnerability was found in H3C SecCenter SMP-E1114P02 up to 20250513. It has been classified as critical. This affects the function fileContent of the file /… |
CVE-2025-48273 | High | 7.5 | 2025-05-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpjobportal WP Job Portal wp-job-portal allows Path Traversal.T… |
CVE-2025-47603 | High | 7.5 | 2025-05-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Belingo belingoGeo belingogeo allows Path Traversal.This issue… |
CVE-2025-47535 | High | 8.6 | 2025-05-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpopal Opal Woo Custom Product Variation opal-woo-custom-produc… |
CVE-2025-47513 | Medium | 4.9 | 2025-05-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in James Laforge Infocob CRM Forms infocob-crm-forms allows Path T… |
CVE-2025-47512 | High | 8.6 | 2025-05-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in tainacan Tainacan tainacan allows Path Traversal.This issue aff… |
CVE-2025-47492 | High | 8.6 | 2025-05-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms drag-… |
CVE-2025-46527 | Medium | 6.5 | 2025-05-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LikeCoin Web3Press likecoin allows Path Traversal.This issue af… |
CVE-2025-46486 | Medium | 4.9 | 2025-05-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in totalprocessing Nomupay Payment Processing Gateway totalprocess… |
CVE-2025-31053 | High | 7.7 | 2025-05-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in quantumcloud KBx Pro Ultimate knowledgebase-helpdesk-pro allows… |
CVE-2025-4419 | Medium | 4.3 | 2025-05-22 | The Hot Random Image plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.9.2 via the 'path' parameter. This makes it p… |
CVE-2025-3884 | High | 7.5 | 2025-05-22 | Cloudera Hue Ace Editor Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information… |
CVE-2025-3486 | High | 8.8 | 2025-05-22 | Allegra isZipEntryValide Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affec… |
CVE-2025-5029 | Medium | 5.4 | 2025-05-21 | A vulnerability has been found in Kingdee Cloud Galaxy Private Cloud BBC System up to 9.0 Patch April 2025 and classified as critical. Affected by this vulnera… |
CVE-2025-4524 | Critical | 9.8 | 2025-05-21 | The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and includi… |
CVE-2025-48017 | Critical | 9.0 | 2025-05-20 | Improper limitation of pathname in Circuit Provisioning and File Import applications allows modification and uploading of files |
CVE-2025-41229 | High | 8.2 | 2025-05-20 | VMware Cloud Foundation contains a directory traversal vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit… |
CVE-2025-3223 | Medium | 5.9 | 2025-05-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in GE Vernova WorkstationST on Windows (EGD Configuration Server m… |
CVE-2025-32926 | Critical | 9.8 | 2025-05-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Path Travers… |
CVE-2025-27566 | Low | 3.8 | 2025-05-19 | Path traversal vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and versions prior to Ver. 3.0.47. This is an issue with insufficient path vali… |
CVE-2025-4912 | Medium | 5.4 | 2025-05-19 | A vulnerability has been found in SourceCodester Student Result Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2025-4898 | Medium | 5.4 | 2025-05-18 | A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as critical. This vulnerability affects the function unl… |
CVE-2025-4893 | Medium | 6.3 | 2025-05-18 | A vulnerability classified as critical has been found in jammy928 CoinExchange_CryptoExchange_Java up to 8adf508b996020d3efbeeb2473d7235bd01436fa. This affects… |
CVE-2025-4868 | Medium | 6.3 | 2025-05-18 | A vulnerability was found in merikbest ecommerce-spring-reactjs up to 464e610bb11cc2619cf6ce8212ccc2d1fd4277fd. It has been rated as critical. Affected by this… |
CVE-2025-47273 | High | 8.8 | 2025-05-17 | setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex`… |
CVE-2025-4807 | Medium | 5.3 | 2025-05-16 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Student Clearance System 1.0. This affects an unknown part. The manipu… |
CVE-2025-40629 | | 2025-05-16 | PNETLab 4.2.10 does not properly sanitize user inputs in its file access mechanisms. This allows attackers to perform directory traversal by manipulating file… | |
CVE-2025-4720 | Medium | 5.4 | 2025-05-15 | A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of… |
CVE-2025-47788 | | 2025-05-15 | Atheos is a self-hosted browser-based cloud IDE. Prior to v602, similar to GHSA-rgjm-6p59-537v/CVE-2025-22152, the `$target` parameter in `/controller.php` was… | |
CVE-2025-4564 | Critical | 9.8 | 2025-05-15 | The TicketBAI Facturas para WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation via the 'delpdf'… |
CVE-2024-13914 | High | 7.2 | 2025-05-15 | The File Manager Advanced Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.4 (file-manager-advanc… |
CVE-2025-43566 | Medium | 6.8 | 2025-05-13 | ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vuln… |
CVE-2025-30387 | Critical | 9.8 | 2025-05-13 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-31493 | Critical | 9.1 | 2025-05-13 | Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby sites that use the `coll… |
CVE-2025-30207 | High | 7.5 | 2025-05-13 | Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby setups that use PHP's bu… |
CVE-2025-28055 | High | 7.5 | 2025-05-13 | upset-gal-web v7.1.0 /api/music/v1/cover.ts contains an arbitrary file read vulnerabilit |
CVE-2024-48766 | High | 8.6 | 2025-05-13 | NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP client can ignore a redirect, and because of factors related to strpos an… |
CVE-2025-30159 | Critical | 9.1 | 2025-05-13 | Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby sites that use the `snip… |
CVE-2025-40573 | Medium | 4.4 | 2025-05-13 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices are vulnerable to path traversal attac… |
CVE-2025-4632 | Critical | 9.8 | 2025-05-13 | Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitr… |
CVE-2024-4982 | High | 7.6 | 2025-05-12 | A directory traversal vulnerability was discovered in Pagure server. If a malicious user submits a specially cratfted git repository they could discover secret… |
CVE-2025-4545 | Medium | 5.4 | 2025-05-11 | A vulnerability was found in CTCMS Content Management System 2.1.2. It has been classified as critical. Affected is the function del of the file ctcms\apps\con… |
CVE-2025-4530 | Medium | 4.3 | 2025-05-11 | A vulnerability was found in feng_ha_ha/megagao ssm-erp and production_ssm 1.0. It has been declared as problematic. Affected by this vulnerability is the func… |
CVE-2025-4529 | Medium | 4.3 | 2025-05-11 | A vulnerability was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. It has been classified as problematic. Affected is the function Download of the… |
CVE-2025-4511 | Medium | 6.3 | 2025-05-10 | A vulnerability was found in vector4wang spring-boot-quick up to 20250422. It has been rated as critical. This issue affects the function ResponseEntity of the… |
CVE-2025-2158 | High | 8.8 | 2025-05-10 | The WordPress Review Plugin: The Ultimate Solution for Building a Review Website plugin for WordPress is vulnerable to Local File Inclusion in all versions up… |
CVE-2025-4206 | High | 7.2 | 2025-05-09 | The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file deletion due to… |
CVE-2025-3897 | Medium | 5.9 | 2025-05-09 | The EUCookieLaw plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.7.2 via the 'file_get_contents' function. Thi… |
CVE-2025-4377 | | 2025-05-09 | Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server. This vulnerability is present in logview.php and it… | |
CVE-2025-44021 | Low | 2.8 | 2025-05-08 | OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment was performed via the API). A malicious… |
CVE-2024-6648 | High | 7.5 | 2025-05-08 | Absolute Path Traversal vulnerability in AP Page Builder versions prior to 4.0.0 could allow an unauthenticated remote user to modify the 'product_item_path' w… |
CVE-2025-32820 | High | 8.8 | 2025-05-07 | A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges can inject a path traversal sequence to make any directory on the… |
CVE-2025-20187 | Medium | 6.5 | 2025-05-07 | A vulnerability in the application data endpoints of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacke… |
CVE-2025-20949 | Medium | 5.1 | 2025-05-07 | Path traversal vulnerability in Samsung Members prior to version 5.0.00.11 allows attackers to read and write arbitrary file with the privilege of Samsung Memb… |
CVE-2025-22479 | Low | 3.5 | 2025-05-06 | Dell Storage Center - Dell Storage Manager, version(s) 20.0.21, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vu… |
CVE-2025-4329 | Medium | 4.3 | 2025-05-06 | A vulnerability was found in 74CMS up to 3.33.0. It has been rated as problematic. Affected by this issue is the function index of the file /index.php/index/do… |
CVE-2025-46559 | Medium | 5.4 | 2025-05-05 | Misskey is an open source, federated social media platform. Starting in version 12.31.0 and prior to version 2025.4.1, missing validation in `Mk:api` allows ma… |
CVE-2025-45239 | Medium | 5.3 | 2025-05-05 | An issue in the restores method (DataBackup.php) of foxcms v2.0.6 allows attackers to execute a directory traversal. |
CVE-2025-45238 | Critical | 9.1 | 2025-05-05 | foxcms v1.2.5 was discovered to contain an arbitrary file deletion vulnerability via the delRestoreSerie method. |
CVE-2024-11615 | Medium | 5.3 | 2025-05-05 | The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.0 via the 'zetra_deleteLanguageFile' a… |
CVE-2024-55913 | Medium | 5.3 | 2025-05-02 | IBM Concert Software 1.0.0 through 1.0.5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL re… |
CVE-2025-4186 | Medium | 6.3 | 2025-05-02 | A vulnerability, which was classified as critical, was found in Wangshen SecGate 3600 2024. Affected is an unknown function of the file /?g=route_ispinfo_expor… |
CVE-2025-4185 | Medium | 6.3 | 2025-05-02 | A vulnerability, which was classified as critical, has been found in Wangshen SecGate 3600 2024. This issue affects some unknown processing of the file ?g=obj_… |
CVE-2025-4178 | Medium | 5.4 | 2025-05-01 | A vulnerability was found in xiaowei1118 java_server up to 11a5bac8f4ba1c17e4bc1b27cad6d24868500e3a on Windows and classified as critical. This issue affects s… |
CVE-2025-4175 | Medium | 6.3 | 2025-05-01 | A vulnerability, which was classified as critical, was found in AlanBinu007 Spring-Boot-Advanced-Projects up to 3.1.3. This affects the function uploadUserProf… |
CVE-2025-46565 | Medium | 5.3 | 2025-05-01 | Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that… |
CVE-2025-27409 | High | 7.5 | 2025-04-30 | Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, pat… |
CVE-2025-4078 | Medium | 4.3 | 2025-04-29 | A vulnerability, which was classified as problematic, has been found in Wangshen SecGate 3600 2400. This issue affects some unknown processing of the file ?g=l… |
CVE-2025-2817 | High | 8.8 | 2025-04-29 | Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By… |
CVE-2025-27937 | Medium | 6.5 | 2025-04-28 | Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory ('Path Traversal'). If exploited, an arbitr… |
CVE-2025-26692 | High | 8.1 | 2025-04-28 | Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory ('Path Traversal'). If exploited, arbitrary… |
CVE-2025-46433 | Medium | 4.9 | 2025-04-25 | In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible |
CVE-2025-28354 | Medium | 6.5 | 2025-04-25 | An issue in the Printer Manager Systm of Entrust Corp Printer Manager D3.18.4-3 and below allows attackers to execute a directory traversal via a crafted POST… |
CVE-2025-1565 | High | 7.5 | 2025-04-25 | The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.4.1 via the library/wave-audio/peaks/remote_… |
CVE-2025-3300 | High | 7.2 | 2025-04-24 | The WPMasterToolKit (WPMTK) – All in one plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.2. This mak… |
CVE-2025-3065 | Critical | 9.1 | 2025-04-24 | The Database Toolset plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and includin… |
CVE-2025-32950 | Medium | 6.5 | 2025-04-22 | Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, attackers cou… |
CVE-2025-34028 | Critical | 10.0 | 2025-04-22 | The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the… |
CVE-2025-23250 | High | 7.6 | 2025-04-22 | NVIDIA NeMo Framework contains a vulnerability where an attacker could cause an improper limitation of a pathname to a restricted directory by an arbitrary fil… |
CVE-2025-3577 | Medium | 4.9 | 2025-04-22 | **UNSUPPORTED WHEN ASSIGNED** A path traversal vulnerability in the web management interface of the Zyxel AMG1302-T10B firmware version 2.00(AAJC.16)C0 could a… |
CVE-2025-28099 | Medium | 4.3 | 2025-04-21 | opencms V2.3 is vulnerable to Arbitrary file read in src/main/webapp/view/admin/document/dataPage.jsp, |
CVE-2025-32431 | Critical | 9.1 | 2025-04-21 | Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. In versions prior to 2.11.24, 3.3.6, and 3.4.0-rc2. There is a potential vulnerability… |