CWE-22 · Path Traversal (page 28)
Page 28 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-29660 | Critical | 9.8 | 2025-04-21 | A vulnerability exists in the daemon process of the Yi IOT XY-3820 v6.0.24.10, which exposes a TCP service on port 6789. This service lacks proper input valida… |
CVE-2025-0632 | | 2025-04-21 | Local File Inclusion (LFI) vulnerability in a Render function of Formulatrix Rock Maker Web (RMW) allows a remote attacker to obtain sensitive data via arbitra… | |
CVE-2025-43928 | Medium | 5.8 | 2025-04-20 | In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversal in the username fi… |
CVE-2025-43919 | Medium | 5.8 | 2025-04-20 | GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/ma… |
CVE-2025-3404 | High | 8.8 | 2025-04-19 | The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the savePackage function in all… |
CVE-2025-3520 | High | 8.1 | 2025-04-18 | The Avatar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and incl… |
CVE-2025-39568 | High | 7.5 | 2025-04-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Arture B.V. StoreContrl Woocommerce storecontrl-wp-connection a… |
CVE-2025-27299 | Medium | 5.3 | 2025-04-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Asia MyTicket Events myticket-events allows Path Traversal.T… |
CVE-2025-27283 | Medium | 6.5 | 2025-04-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rockgod100 Theme File Duplicator theme-file-duplicator allows P… |
CVE-2025-3295 | Medium | 4.9 | 2025-04-17 | The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated… |
CVE-2025-3294 | High | 7.2 | 2025-04-17 | The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and including, 1.2.9.1. Th… |
CVE-2025-28072 | High | 7.5 | 2025-04-16 | PHPGurukul Pre-School Enrollment System is vulnerable to Directory Traversal in manage-teachers.php. |
CVE-2025-3686 | Medium | 4.3 | 2025-04-16 | A vulnerability classified as problematic was found in misstt123 oasys 1.0. Affected by this vulnerability is the function image of the file /show. The manipul… |
CVE-2025-29213 | Medium | 5.5 | 2025-04-15 | A zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS v3.7 allows attackers to execute arbitrary code via a crafted Zip file. |
CVE-2025-32779 | Medium | 6.5 | 2025-04-15 | E.D.D.I (Enhanced Dialog Driven Interface) is a middleware to connect and manage LLM API bots. In versions before 5.5.0, an attacker with access to the `/backu… |
CVE-2025-2830 | Medium | 6.3 | 2025-04-15 | By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when t… |
CVE-2025-32103 | Medium | 5.0 | 2025-04-15 | CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at… |
CVE-2025-32943 | Low | 3.7 | 2025-04-15 | The vulnerability allows any authenticated user to leak the contents of arbitrary “.m3u8” files from the PeerTube server due to a path traversal in the HLS end… |
CVE-2025-3562 | Medium | 4.3 | 2025-04-14 | A vulnerability was found in Yonyou YonBIP MA2.7. It has been declared as problematic. Affected by this vulnerability is the function FileInputStream of the fi… |
CVE-2025-3547 | Medium | 6.3 | 2025-04-14 | A vulnerability classified as critical was found in frdel Agent-Zero 0.8.1.2. This vulnerability affects unknown code of the file /get_work_dir_files. The mani… |
CVE-2025-3445 | High | 8.1 | 2025-04-13 | A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file containing path trave… |
CVE-2023-42961 | Medium | 6.3 | 2025-04-11 | A path handling issue was addressed with improved validation. This issue is fixed in iOS 17 and iPadOS 17, iOS 16.7 and iPadOS 16.7, macOS Sonoma 14, macOS Ven… |
CVE-2025-32671 | High | 7.5 | 2025-04-11 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in John Weissberg Print Science Designer print-science-designer al… |
CVE-2025-32633 | High | 8.6 | 2025-04-11 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in neoslab Database Toolset database-toolset allows Path Traversal… |
CVE-2025-32631 | High | 8.6 | 2025-04-11 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in oxygensuite Oxygen MyData for WooCommerce oxygen-mydata allows… |
CVE-2025-32629 | High | 8.6 | 2025-04-11 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDir… |
CVE-2025-32587 | High | 8.1 | 2025-04-11 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pickupp WooCommerce Pickupp wc-pickupp allows PHP Local File In… |
CVE-2025-32509 | High | 7.5 | 2025-04-11 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMinds Simple WP Events simple-wp-events allows Path Traversal… |
CVE-2025-2636 | High | 8.1 | 2025-04-11 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85… |
CVE-2025-31411 | Medium | 5.9 | 2025-04-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in aribhour Linet ERP-Woocommerce Integration linet-erp-woocommerc… |
CVE-2025-32209 | Medium | 6.5 | 2025-04-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in totalprocessing Nomupay Payment Processing Gateway totalprocess… |
CVE-2025-32205 | Low | 2.7 | 2025-04-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in piotnetdotcom Piotnet Forms piotnetforms.This issue affects Pio… |
CVE-2025-30582 | High | 8.1 | 2025-04-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in aytechnet DyaPress ERP/CRM dyapress allows PHP Local File Inclu… |
CVE-2025-30290 | High | 8.7 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vuln… |
CVE-2025-27085 | Medium | 4.9 | 2025-04-08 | Multiple vulnerabilities exist in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor. Successful exploitation of these vul… |
CVE-2025-32018 | High | 8.0 | 2025-04-08 | Cursor is a code editor built for programming with AI. In versions 0.45.0 through 0.48.6, the Cursor app introduced a regression affecting the set of file path… |
CVE-2025-25254 | High | 7.2 | 2025-04-08 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb version 7.6.2 and below, version 7.4.6 and… |
CVE-2024-41792 | High | 8.6 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices contains a path traversal vulnera… |
CVE-2025-2519 | Medium | 6.5 | 2025-04-08 | The Sreamit theme for WordPress is vulnerable to arbitrary file downloads in all versions up to, and including, 4.0.1. This is due to insufficient file validat… |
CVE-2025-3381 | Medium | 6.3 | 2025-04-07 | A vulnerability, which was classified as critical, was found in zhangyanbo2007 youkefu 4.2.0. This affects an unknown part of the file WebIMController.java of… |
CVE-2025-3424 | | 2025-04-07 | The IntelliSpace portal application utilizes .NET Remoting for its functionality. The vulnerability arises from the exploitation of port 755 through the "Objec… | |
CVE-2025-31174 | Medium | 6.8 | 2025-04-07 | Path traversal vulnerability in the DFS module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-3317 | Medium | 4.3 | 2025-04-06 | A vulnerability classified as problematic has been found in fumiao opencms up to a0fafa5cff58719e9b27c2a2eec204cc165ce14f. Affected is an unknown function of t… |
CVE-2025-2941 | Critical | 9.8 | 2025-04-05 | The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via… |
CVE-2025-3214 | Medium | 4.3 | 2025-04-04 | A vulnerability has been found in JFinal CMS up to 5.2.4 and classified as problematic. Affected by this vulnerability is the function engine.getTemplate of th… |
CVE-2025-2270 | High | 8.1 | 2025-04-04 | The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2… |
CVE-2025-31827 | Medium | 4.9 | 2025-04-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vlad.olaru Fonto fonto allows Path Traversal.This issue affects… |
CVE-2025-31825 | Medium | 4.9 | 2025-04-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pixelgrade Category Icon category-icon allows Path Traversal.Th… |
CVE-2025-31800 | Medium | 6.5 | 2025-04-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in publitio Publitio publitio allows Path Traversal.This issue aff… |
CVE-2025-31554 | Medium | 5.9 | 2025-04-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in docxpresso Docxpresso docxpresso allows Absolute Path Traversal… |
CVE-2025-30596 | Medium | 6.5 | 2025-04-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in tstafford include-file include-file allows Path Traversal.This… |
CVE-2025-22926 | Critical | 9.8 | 2025-04-03 | An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messagi… |
CVE-2025-22927 | Critical | 9.1 | 2025-04-03 | An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messagi… |
CVE-2025-22923 | High | 8.8 | 2025-04-02 | An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to /Modules.ph… |
CVE-2023-46988 | Medium | 6.7 | 2025-04-01 | Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote attacker to copy arbitrary files by manipulating the fileExt parameter… |
CVE-2025-30841 | Critical | 9.9 | 2025-04-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in adamskaat Countdown & Clock countdown-builder allows Remote Cod… |
CVE-2025-31131 | High | 8.6 | 2025-04-01 | YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server… |
CVE-2025-30910 | High | 8.6 | 2025-04-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CreativeMindsSolutions CM Download Manager cm-download-manager… |
CVE-2025-30882 | High | 7.5 | 2025-04-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JoomSky JS Help Desk js-support-ticket allows Path Traversal.Th… |
CVE-2025-30878 | High | 8.6 | 2025-04-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JoomSky JS Help Desk js-support-ticket allows Path Traversal.Th… |
CVE-2025-30793 | High | 7.5 | 2025-04-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Property Hive Houzez Property Feed houzez-property-feed allows… |
CVE-2025-30594 | Medium | 6.5 | 2025-04-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in samsk Include URL include-url allows Path Traversal.This issue… |
CVE-2025-2048 | Medium | 4.1 | 2025-04-01 | The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin role to perform pa… |
CVE-2025-3043 | Medium | 5.3 | 2025-04-01 | A vulnerability, which was classified as critical, has been found in GuoMinJim PersonManage 1.0. This issue affects the function preHandle of the file /login/… |
CVE-2025-30470 | Medium | 5.5 | 2025-03-31 | A path handling issue was addressed with improved logic. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventur… |
CVE-2025-30005 | High | 8.3 | 2025-03-31 | Xorcom CompletePBX is vulnerable to a path traversal via the Diagnostics reporting module, which will allow reading of arbitrary files and additionally delete… |
CVE-2025-2292 | Medium | 6.5 | 2025-03-31 | Xorcom CompletePBX is vulnerable to an authenticated path traversal, allowing for arbitrary file reads via the Backup and Restore functionality.This issue affe… |
CVE-2025-3021 | | 2025-03-31 | Path Traversal vulnerability in e-solutions e-management. This vulnerability could allow an attacker to access confidential files outside the expected scope vi… | |
CVE-2025-2917 | Medium | 4.3 | 2025-03-28 | A vulnerability, which was classified as problematic, was found in ChestnutCMS up to 1.5.3. Affected is the function readFile of the file /dev-api/cms/file/rea… |
CVE-2024-54291 | High | 8.6 | 2025-03-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in labs64 PluginPass pluginpass-pro-plugintheme-licensing allows M… |
CVE-2025-27932 | High | 8.1 | 2025-03-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file deletion process of the USB storage file-sharing functi… |
CVE-2025-27726 | Low | 2.1 | 2025-03-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file download process of the USB storage file-sharing functi… |
CVE-2025-27718 | High | 8.8 | 2025-03-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file upload process of the USB storage file-sharing function… |
CVE-2025-27716 | Medium | 6.5 | 2025-03-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file/folder listing process of the USB storage file-sharing… |
CVE-2025-2328 | High | 8.8 | 2025-03-28 | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validatio… |
CVE-2025-2294 | Critical | 9.8 | 2025-03-28 | The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via thekubio_hybrid_theme_load… |
CVE-2024-12905 | High | 7.5 | 2025-03-27 | An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vuln… |
CVE-2025-30895 | High | 7.5 | 2025-03-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in magepeopleteam WpEvently mage-eventpress allows PHP Local File… |
CVE-2025-1769 | Medium | 4.9 | 2025-03-26 | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Directory Traversal in all versions up to, an… |
CVE-2025-1310 | Medium | 6.5 | 2025-03-26 | The Jobs for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.11 via the 'job_postings_get_file' p… |
CVE-2025-29789 | High | 7.5 | 2025-03-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.3.0 are vulnerable to Directory Tr… |
CVE-2025-27837 | Critical | 9.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for… |
CVE-2025-25371 | High | 7.5 | 2025-03-25 | NASA cFS (Core Flight System) Aquila is vulnerable to path traversal in the OSAL module, allowing the override of any arbitrary file on the system. |
CVE-2025-30567 | High | 7.5 | 2025-03-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP01 WP01 wp01 allows Path Traversal.This issue affects WP01: f… |
CVE-2025-27147 | High | 8.2 | 2025-03-25 | The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deployment, VMWare ESX hos… |
CVE-2025-2744 | Medium | 5.4 | 2025-03-25 | A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/mp/ma… |
CVE-2025-2743 | Medium | 4.3 | 2025-03-25 | A vulnerability, which was classified as problematic, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. This issue affects some unknown processing of the fi… |
CVE-2025-2742 | Medium | 5.4 | 2025-03-25 | A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. This vulnerability affects unknown code of the file /admin-api/mp/materi… |
CVE-2025-2716 | Low | 2.7 | 2025-03-24 | A vulnerability classified as problematic was found in China Mobile P22g-CIac 1.0.00.488. This vulnerability affects unknown code of the component Samba Path H… |
CVE-2025-2708 | Medium | 5.4 | 2025-03-24 | A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. This affects an unknown part of the file /admin-api/infra/fi… |
CVE-2025-2749 | High | 7.2 | 2025-03-24 | An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations… |
CVE-2025-2707 | Medium | 5.4 | 2025-03-24 | A vulnerability, which was classified as critical, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this issue is some unknown functionality of… |
CVE-2025-1973 | Medium | 4.9 | 2025-03-22 | The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.6.2 via the download_fil… |
CVE-2025-30343 | Low | 3.0 | 2025-03-21 | A directory traversal issue was discovered in OpenSlides before 4.2.5. Files can be uploaded to OpenSlides meetings and organized in folders. The interface all… |
CVE-2024-13920 | Medium | 4.9 | 2025-03-20 | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.0 via the d… |
CVE-2024-9597 | High | 7.1 | 2025-03-20 | A Path Traversal vulnerability exists in the `/wipe_database` endpoint of parisneo/lollms version v12, allowing an attacker to delete any directory on the syst… |
CVE-2024-9415 | High | 8.8 | 2025-03-20 | A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. This vulnerability allows an attacker to… |
CVE-2024-9362 | High | 7.5 | 2025-03-20 | An unauthenticated directory traversal vulnerability exists in Polyaxon, affecting the latest version. This vulnerability allows an attacker to retrieve direct… |
CVE-2024-8898 | Critical | 9.8 | 2025-03-20 | A path traversal vulnerability exists in the `install` and `uninstall` API endpoints of parisneo/lollms-webui version V12 (Strawberry). This vulnerability allo… |
CVE-2024-8769 | Critical | 9.1 | 2025-03-20 | A vulnerability in the `LockManager.release_locks` function in aimhubio/aim (commit bb76afe) allows for arbitrary file deletion through relative path traversal… |