CWE-22 · Path Traversal (page 30)
Page 30 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1336 | Medium | 4.3 | 2025-02-16 | A vulnerability has been found in CmsEasy 7.7.7.9 and classified as problematic. Affected by this vulnerability is the function deleteimg_action in the library… |
CVE-2025-1335 | Medium | 4.3 | 2025-02-16 | A vulnerability, which was classified as problematic, was found in CmsEasy 7.7.7.9. Affected is the function deleteimg_action in the library lib/admin/file_adm… |
CVE-2025-0822 | Medium | 6.5 | 2025-02-15 | Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This makes it possible fo… |
CVE-2025-25997 | High | 7.5 | 2025-02-14 | Directory Traversal vulnerability in FeMiner wms v.1.0 allows a remote attacker to obtain sensitive information via the databak.php component. |
CVE-2025-25295 | | 2025-02-14 | Label Studio is an open source data labeling tool. A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access… | |
CVE-2024-56477 | Medium | 6.5 | 2025-02-14 | IBM Power Hardware Management Console V10.3.1050.0 could allow an authenticated user to traverse directories on the system. An attacker could send a specially… |
CVE-2024-13791 | Medium | 4.9 | 2025-02-14 | Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the downloadResponseFile() function. This makes… |
CVE-2025-1127 | Critical | 9.1 | 2025-02-13 | The vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user and/or modify the contents of any data on the filesystem. |
CVE-2025-24889 | Medium | 4.5 | 2025-02-13 | The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation. Prior to ve… |
CVE-2025-24888 | High | 8.1 | 2025-02-13 | The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation. Prior to ve… |
CVE-2024-47266 | Low | 2.7 | 2025-02-13 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in share file list functionality in Synology Active Backup for Bus… |
CVE-2024-47264 | Medium | 4.9 | 2025-02-13 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in agent-related functionality in Synology Active Backup for Busin… |
CVE-2024-10763 | Critical | 9.8 | 2025-02-13 | The Campress theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.35 via the 'campress_woocommerce_get_ajax_produc… |
CVE-2024-51376 | High | 7.5 | 2025-02-12 | Directory Traversal vulnerability in yeqifu carRental v.1.0 allows a remote attacker to obtain sensitive information via the file/downloadFile.action?path= com… |
CVE-2024-34521 | Low | 3.5 | 2025-02-12 | A directory traversal vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R_1_0_24_0, which allows an administrative us… |
CVE-2025-1228 | Medium | 4.3 | 2025-02-12 | A vulnerability classified as problematic has been found in olajowon Loggrove up to e428fac38cc480f011afcb1d8ce6c2bad378ddd6. Affected is an unknown function o… |
CVE-2024-6097 | Medium | 5.3 | 2025-02-12 | In Progress® Telerik® Reporting versions prior to 2025 Q1 (19.0.25.211), information disclosure is possible by a local threat actor through an absolute path vu… |
CVE-2025-0332 | High | 7.8 | 2025-02-12 | In Progress® Telerik® UI for WinForms, versions prior to 2025 Q1 (2025.1.211), using the improper limitation of a target path can lead to decompressing an arch… |
CVE-2024-11343 | High | 8.3 | 2025-02-12 | In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), unzipping an archive can lead to arbitrary file system access. |
CVE-2024-57777 | Medium | 5.1 | 2025-02-11 | Directory Traversal vulnerability in Ianproxy v.0.1 and before allows a remote attacker to obtain sensitive information |
CVE-2025-24406 | High | 7.5 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Limitation of a Pathname to a Restricted… |
CVE-2024-36508 | Medium | 6.0 | 2025-02-11 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.4.0 through 7.4.2 a… |
CVE-2024-11771 | Medium | 5.3 | 2025-02-11 | Path traversal in Ivanti CSA before version 5.0.5 allows a remote unauthenticated attacker to access restricted functionality. |
CVE-2025-25243 | High | 8.6 | 2025-02-11 | SAP Supplier Relationship Management (Master Data Management Catalog) allows an unauthenticated attacker to use a publicly available servlet to download an arb… |
CVE-2024-13059 | High | 7.2 | 2025-02-10 | A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer li… |
CVE-2024-8685 | Medium | 4.3 | 2025-02-10 | Path-Traversal vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an authenticated attacker to lis… |
CVE-2025-1106 | Medium | 5.4 | 2025-02-07 | A vulnerability classified as critical has been found in CmsEasy 7.7.7.9. This affects the function deletedir_action/restore_action in the library lib/admin/da… |
CVE-2024-57248 | Medium | 6.3 | 2025-02-07 | Directory Traversal in File Upload in Gleamtech FileVista 9.2.0.0 allows remote attackers to achieve Code Execution, Information Disclosure, and Escalation of… |
CVE-2024-55214 | Medium | 6.5 | 2025-02-07 | Local File Inclusion vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the file download functionality. |
CVE-2024-55213 | Medium | 6.5 | 2025-02-07 | Directory Traversal vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the File Listing function. |
CVE-2024-52883 | High | 7.5 | 2025-02-07 | An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to a path traversal vulnerability, sensitive data can be read with… |
CVE-2025-25163 | High | 7.5 | 2025-02-07 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Zach Swetz Plugin A/B Image Optimizer images-optimizer allows P… |
CVE-2025-25155 | High | 7.5 | 2025-02-07 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in efreja Music Sheet Viewer music-sheet-viewer allows Path Traver… |
CVE-2024-54909 | High | 8.1 | 2025-02-06 | A vulnerability has been identified in GoldPanKit eva-server v4.1.0. It affects the path parameter of the /api/resource/local/download endpoint, where manipula… |
CVE-2024-53586 | Medium | 5.3 | 2025-02-06 | An issue in the relPath parameter of WebFileSys version 2.31.0 allows attackers to perform directory traversal via a crafted HTTP request. By injecting travers… |
CVE-2025-24786 | Critical | 10.0 | 2025-02-06 | WhoDB is an open source database management tool. While the application only displays Sqlite3 databases present in the directory `/db`, there is no path traver… |
CVE-2025-0859 | Medium | 6.5 | 2025-02-06 | The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including… |
CVE-2025-0799 | Medium | 6.5 | 2025-02-06 | IBM App Connect enterprise 12.0.1.0 through 12.0.12.10 and 13.0.1.0 through 13.0.2.1 could allow an authenticated user to write to an arbitrary file on the sys… |
CVE-2025-22601 | Low | 3.1 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions an attacker can trick a target user to make changes to their own username v… |
CVE-2025-24963 | Medium | 5.9 | 2025-02-04 | Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Espe… |
CVE-2024-48019 | Medium | 5.4 | 2025-02-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Files or Directories Accessible to External Parties vulnerability in Apache Dor… |
CVE-2025-23059 | Medium | 6.8 | 2025-02-04 | A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensitive information. If… |
CVE-2025-22205 | High | 7.5 | 2025-02-04 | Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x. |
CVE-2025-24961 | | 2025-02-03 | org.gaul S3Proxy implements the S3 API and proxies requests. Users of the filesystem and filesystem-nio2 storage backends could unintentionally expose local fi… | |
CVE-2025-24960 | High | 8.7 | 2025-02-03 | Jellystat is a free and open source Statistics App for Jellyfin. In affected versions Jellystat is directly using a user input in the route(s). This can lead t… |
CVE-2024-57451 | High | 7.5 | 2025-02-03 | ChestnutCMS <=1.5.0 has a directory traversal vulnerability in contentcore.controller.FileController#getFileList, which allows attackers to view any directory. |
CVE-2024-57669 | High | 7.5 | 2025-02-03 | Directory Traversal vulnerability in Zrlog backup-sql-file.jar v.3.0.31 allows a remote attacker to obtain sensitive information via the BackupController.java… |
CVE-2025-24605 | Medium | 4.9 | 2025-02-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RealMag777 WOLF bulk-editor allows Path Traversal.This issue af… |
CVE-2025-24569 | High | 7.5 | 2025-02-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RedefiningTheWeb PDF Generator Addon for Elementor Page Builder… |
CVE-2025-23819 | High | 7.5 | 2025-02-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Marco Milesi WP Cloud cloud allows Absolute Path Traversal.This… |
CVE-2025-0973 | Medium | 5.4 | 2025-02-03 | A vulnerability classified as critical was found in CmsEasy 7.7.7.9. This vulnerability affects the function backAll_action in the library lib/admin/database_a… |
CVE-2025-0365 | Medium | 6.5 | 2025-02-01 | The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.8.7 via the inline SVG feature. This makes… |
CVE-2024-51534 | High | 7.1 | 2025-02-01 | Dell PowerProtect DD versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.20 contain a path traversal vulnerability. A local low privileged could potentially… |
CVE-2025-24891 | Critical | 9.6 | 2025-01-31 | Dumb Drop is a file upload application. Users with permission to upload to the service are able to exploit a path traversal vulnerability to overwrite arbitrar… |
CVE-2024-53582 | High | 7.5 | 2025-01-31 | An issue found in the Copy and View functions in the File Manager component of OpenPanel v0.3.4 allows attackers to execute a directory traversal via a crafted… |
CVE-2024-53537 | Critical | 9.1 | 2025-01-31 | An issue in OpenPanel v0.3.4 to v0.2.1 allows attackers to execute a directory traversal in File Actions of File Manager. |
CVE-2025-0493 | Critical | 9.8 | 2025-01-31 | The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Limited Local File Inclusion in all version… |
CVE-2023-0092 | Medium | 4.9 | 2025-01-31 | An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's file… |
CVE-2025-0573 | Medium | 5.3 | 2025-01-30 | Sante PACS Server DCM File Parsing Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbitrary files… |
CVE-2025-0572 | Medium | 4.3 | 2025-01-30 | Sante PACS Server Web Portal DCM File Parsing Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbi… |
CVE-2024-55415 | Medium | 5.7 | 2025-01-30 | DevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass. |
CVE-2024-13720 | High | 8.8 | 2025-01-30 | The WP Image Uploader plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the gky_image_uploader_main_fun… |
CVE-2024-13671 | High | 7.5 | 2025-01-30 | The Music Sheet Viewer plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.1 via the read_score_file() function… |
CVE-2024-54462 | High | 7.1 | 2025-01-29 | The file names constructed within image_picker are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in case… |
CVE-2024-54461 | High | 7.1 | 2025-01-29 | The file names constructed within file_selector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cas… |
CVE-2025-0750 | Medium | 6.6 | 2025-01-28 | A vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerLogs) may allow an attacker with pe… |
CVE-2025-23084 | Medium | 5.5 | 2025-01-28 | A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not… |
CVE-2024-57549 | High | 7.5 | 2025-01-27 | CMSimple 5.16 allows the user to read cms source code through manipulation of the file name in the file parameter of a GET request. |
CVE-2024-54520 | Medium | 5.5 | 2025-01-27 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may… |
CVE-2024-45598 | Medium | 6.0 | 2025-01-27 | Cacti is an open source performance and fault management framework. Prior to 1.2.29, an administrator can change the `Poller Standard Error Log Path` parameter… |
CVE-2025-0542 | High | 7.8 | 2025-01-25 | Local privilege escalation due to incorrect assignment of privileges of temporary files in the update mechanism of G DATA Management Server. This vulnerability… |
CVE-2023-38012 | Medium | 5.3 | 2025-01-25 | IBM Cloud Pak System 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could allow a remote attacker to traverse directories on the sy… |
CVE-2024-13550 | Medium | 6.5 | 2025-01-25 | The ABC Notation plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.1.3 via the 'file' attribute of the 'abcjs' short… |
CVE-2024-12885 | Medium | 6.5 | 2025-01-25 | The Connections Business Directory plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation when deleting a… |
CVE-2025-0703 | Medium | 4.3 | 2025-01-24 | A vulnerability, which was classified as problematic, has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. This issue affects s… |
CVE-2025-24611 | Medium | 4.9 | 2025-01-24 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Smackcoders Inc., WP Ultimate Exporter wp-ultimate-exporter all… |
CVE-2025-23422 | High | 7.5 | 2025-01-24 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in moaluko Store Locator store-locator allows PHP Local File Inclu… |
CVE-2024-13409 | High | 7.5 | 2025-01-24 | The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in al… |
CVE-2024-13545 | Critical | 9.8 | 2025-01-24 | The Bootstrap Ultimate theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.9 via the path parameter. This makes… |
CVE-2024-55926 | High | 7.6 | 2025-01-23 | A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploitin… |
CVE-2024-42187 | Medium | 5.3 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by path traversal vulnerability. The application could allow operators to download files from a local repository w… |
CVE-2025-23562 | Medium | 5.8 | 2025-01-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pitinca XLSXviewer xlsx-viewer allows Path Traversal.This issue… |
CVE-2025-24019 | High | 7.1 | 2025-01-21 | YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for any authenticated user, through the use of the filemanager t… |
CVE-2025-0615 | Medium | 5.3 | 2025-01-21 | Input validation vulnerability in Qualifio's Wheel of Fortune. This vulnerability allows an attacker to modify an email to contain the ‘+’ symbol to access the… |
CVE-2025-0614 | Medium | 5.3 | 2025-01-21 | Input validation vulnerability in Qualifio's Wheel of Fortune. This vulnerability could allow an attacker to modify a single email to contain upper and lower c… |
CVE-2024-45652 | Medium | 6.5 | 2025-01-19 | IBM Maximo MXAPIASSET API 7.6.1.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request c… |
CVE-2024-10799 | Medium | 6.5 | 2025-01-17 | The Eventer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.9.7 via the eventer_woo_download_tickets() functi… |
CVE-2024-52363 | Medium | 6.5 | 2025-01-17 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL requ… |
CVE-2024-57784 | Medium | 5.5 | 2025-01-16 | An issue in the component /php/script_uploads.php of Zenitel AlphaWeb XE v11.2.3.10 allows attackers to execute a directory traversal. |
CVE-2024-48885 | Medium | 5.3 | 2025-01-16 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0… |
CVE-2024-57728 | High | 7.2 | 2025-01-15 | SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (… |
CVE-2024-57727 | High | 7.5 | 2025-01-15 | SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to d… |
CVE-2024-54535 | Medium | 4.3 | 2025-01-15 | A path handling issue was addressed with improved logic. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, visionOS 2.1, watchOS 11.1. An at… |
CVE-2025-22786 | High | 7.5 | 2025-01-15 | Path Traversal: '.../...//' vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows PHP Local File Incl… |
CVE-2024-13158 | High | 7.2 | 2025-01-14 | An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenti… |
CVE-2024-12088 | Medium | 6.5 | 2025-01-14 | A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server… |
CVE-2024-12087 | Medium | 6.5 | 2025-01-14 | A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client option… |
CVE-2024-13181 | High | 7.3 | 2025-01-14 | Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. This CVE addresses incomplete fixes… |
CVE-2024-13180 | High | 7.5 | 2025-01-14 | Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive information. This CVE addresses incomplete f… |
CVE-2024-13179 | High | 7.3 | 2025-01-14 | Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. |