CWE-35 · Path Traversal: '.../...//' (page 2)
Page 2 of 2 — CVEs classified under CWE-35, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-26357 | Medium | 4.9 | 2025-02-12 | A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker t… |
CVE-2025-26356 | High | 7.2 | 2025-02-12 | A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authentica… |
CVE-2025-26355 | Medium | 6.5 | 2025-02-12 | A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker t… |
CVE-2025-26354 | High | 7.2 | 2025-02-12 | A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated r… |
CVE-2025-26353 | Medium | 4.9 | 2025-02-12 | A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sen… |
CVE-2025-26352 | Medium | 6.5 | 2025-02-12 | A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to… |
CVE-2025-26351 | Medium | 4.9 | 2025-02-12 | A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to… |
CVE-2025-24786 | Critical | 10.0 | 2025-02-06 | WhoDB is an open source database management tool. While the application only displays Sqlite3 databases present in the directory `/db`, there is no path traver… |
CVE-2025-0858 | | 2025-02-05 | A vulnerability was discovered in the firmware builds up to 8.2.1.0820 in certain Poly devices. The firmware flaw does not properly prevent path traversal and… | |
CVE-2025-24685 | High | 8.1 | 2025-01-27 | Path Traversal: '.../...//' vulnerability in Ihor Kit Morkva UA Shipping morkva-ua-shipping allows PHP Local File Inclusion.This issue affects Morkva UA Shippi… |
CVE-2025-22786 | High | 7.5 | 2025-01-15 | Path Traversal: '.../...//' vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows PHP Local File Incl… |
CVE-2024-49249 | High | 8.6 | 2025-01-07 | Path Traversal: '.../...//' vulnerability in SMSA Express SMSA Shipping smsa-shipping-official allows Path Traversal.This issue affects SMSA Shipping: from n/a… |
CVE-2024-56045 | Critical | 9.3 | 2024-12-31 | Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5. |
CVE-2024-56214 | High | 8.3 | 2024-12-31 | Path Traversal: '.../...//' vulnerability in DeluxeThemes Userpro userpro allows Path Traversal.This issue affects Userpro: from n/a through <= 5.1.9. |
CVE-2024-56213 | Medium | 6.5 | 2024-12-31 | Path Traversal: '.../...//' vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through <= 4.0.7. |
CVE-2023-7263 | High | 7.3 | 2024-12-28 | Some Huawei home music system products have a path traversal vulnerability. Successful exploitation of this vulnerability may cause unauthorized file deletion… |
CVE-2023-7300 | High | 8.0 | 2024-12-26 | Huawei Home Music System has a path traversal vulnerability. Successful exploitation of this vulnerability may cause the music host file to be deleted or the f… |
CVE-2024-56055 | High | 8.5 | 2024-12-18 | Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2. |
CVE-2024-56049 | High | 8.5 | 2024-12-18 | Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2. |
CVE-2024-54313 | Medium | 6.5 | 2024-12-13 | Path Traversal vulnerability in FULL. FULL Customer allows Path Traversal.This issue affects FULL Customer: from n/a through 3.1.25. |
CVE-2024-21575 | High | 8.6 | 2024-12-12 | ComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the `image.filename` field in a POST request sent to the `/uplo… |
CVE-2024-54216 | High | 7.7 | 2024-12-06 | Path Traversal: '.../...//' vulnerability in reputeinfosystems ARForms allows Path Traversal. This issue affects ARForms: from n/a before 7.0.2. |
CVE-2024-52498 | High | 7.5 | 2024-11-28 | Path Traversal: '.../...//' vulnerability in softpulseinfotech SP Blog Designer sp-blog-designer allows PHP Local File Inclusion.This issue affects SP Blog Des… |
CVE-2024-10857 | Medium | 6.5 | 2024-11-26 | The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 via the handle_dow… |
CVE-2024-50054 | High | 7.5 | 2024-11-22 | The back-end does not sufficiently verify the user-controlled filename parameter which makes it possible for an attacker to perform a path traversal attack and… |
CVE-2024-52447 | High | 8.6 | 2024-11-20 | Path Traversal: '.../...//' vulnerability in corporatezen222 Contact Page With Google Map contact-page-with-google-map allows Path Traversal.This issue affects… |
CVE-2024-52390 | Medium | 4.9 | 2024-11-18 | Path Traversal: '.../...//' vulnerability in Greg Ross CYAN Backup cyan-backup allows Path Traversal.This issue affects CYAN Backup: from n/a through <= 2.5.3. |
CVE-2021-1132 | Medium | 5.3 | 2024-11-18 | A vulnerability in the API subsystem and in the web-management interface of Cisco Network Services Orchestrator (NSO) could allow an unauthenticated, remo… |
CVE-2020-26073 | High | 7.5 | 2024-11-18 | A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to gain access to sensi… |
CVE-2024-41973 | High | 8.1 | 2024-11-18 | A low privileged remote attacker can specify an arbitrary file on the filesystem which may lead to an arbitrary file writes with root privileges. |
CVE-2024-41972 | Medium | 6.5 | 2024-11-18 | A low privileged remote attacker can overwrite an arbitrary file on the filesystem which may lead to an arbitrary file read with root privileges. |
CVE-2024-11136 | | 2024-11-14 | The default TCL Camera application exposes a provider vulnerable to path traversal vulnerability. Malicious application can supply malicious URI path and delet… | |
CVE-2024-51582 | High | 7.5 | 2024-11-04 | Path Traversal: '.../...//' vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows PHP Local File Inclusion.This issue affects WP Hotel Booking: f… |
CVE-2024-49770 | | 2024-11-01 | `oak` is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. By default `oak` does not allow… | |
CVE-2024-49258 | Medium | 6.5 | 2024-10-16 | Path Traversal: '.../...//' vulnerability in Limbcode WordPress Gallery Plugin – Limb Image Gallery limb-gallery.This issue affects WordPress Gallery Plugin –… |
CVE-2024-45248 | High | 7.5 | 2024-10-06 | Multi-DNC – CWE-35: Path Traversal: '.../...//' |
CVE-2024-47324 | High | 7.5 | 2024-10-05 | Path Traversal: '.../...//' vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines.This issue affects WP Timeline – Vert… |
CVE-2024-47171 | Medium | 4.3 | 2024-09-26 | Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to up… |
CVE-2024-47170 | Medium | 4.3 | 2024-09-26 | Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to re… |
CVE-2024-47169 | High | 8.8 | 2024-09-26 | Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to up… |
CVE-2024-0067 | Medium | 4.3 | 2024-09-10 | Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API ledlimit.cgi was vulnerable for path traversal attacks allowing to list folde… |
CVE-2024-7608 | Medium | 5.9 | 2024-08-27 | An authenticated user can access the restricted files from NX, EX, FX, AX, IVX and CMS using path traversal. |
CVE-2024-45190 | Medium | 6.5 | 2024-08-23 | Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Pipeline Interaction" request |
CVE-2024-0113 | High | 7.5 | 2024-08-12 | NVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC contain a vulnerability in the web support, where an attacker can cause a CGI path traversal by a specially… |
CVE-2024-40505 | Critical | 9.3 | 2024-07-16 | Directory Traversal vulnerability in D-Link DAP-1650 Firmware v.1.03 allows a local attacker to escalate privileges via the hedwig.cgi component. |
CVE-2024-38706 | Medium | 6.5 | 2024-07-12 | Path Traversal: '.../...//' vulnerability in DevItems HT Mega ht-mega-for-elementor.This issue affects HT Mega: from n/a through <= 2.5.7. |
CVE-2024-39171 | Critical | 9.8 | 2024-07-09 | Directory Travel in PHPVibe v11.0.46 due to incomplete blacklist checksums and directory checks, which can lead to code execution via writing specific statemen… |
CVE-2024-36991 | High | 7.5 | 2024-07-01 | In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splu… |
CVE-2024-5481 | Medium | 6.8 | 2024-06-07 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.8.23 vi… |
CVE-2024-34191 | Medium | 6.5 | 2024-05-14 | htmly v2.9.6 was discovered to contain an arbitrary file deletion vulnerability via the delete_post() function at admin.php. This vulnerability allows attacker… |
CVE-2024-2654 | Medium | 6.8 | 2024-04-09 | The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.2.5 via the fm_download_backup function. Thi… |
CVE-2024-27901 | High | 7.2 | 2024-04-09 | SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to… |
CVE-2024-2863 | Medium | 5.3 | 2024-03-25 | This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant. |
CVE-2023-41793 | Medium | 6.7 | 2024-03-19 | : Path Traversal vulnerability in Pandora FMS on all allows Path Traversal. This vulnerability allowed changing directories and creating files and downloading… |
CVE-2024-1886 | Low | 3.0 | 2024-02-26 | This vulnerability allows remote attackers to traverse the directory on the affected webOS of LG Signage. |
CVE-2023-5800 | Medium | 5.4 | 2024-02-05 | Vintage, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi did not have a sufficient input validation allowing for a po… |
CVE-2023-46690 | High | 8.8 | 2023-11-30 | In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an attacker to write to any file to any location of the filesystem, w… |
CVE-2023-5885 | Medium | 6.5 | 2023-11-27 | The discontinued FFS Colibri product allows a remote user to access files on the system including files containing login credentials for other users. |
CVE-2023-6252 | High | 7.5 | 2023-11-22 | Path traversal vulnerability in Chalemelon Power framework, affecting the getImage parameter. This vulnerability could allow a remote user to read files locate… |
CVE-2023-21418 | High | 7.1 | 2023-11-21 | Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks that allows for fil… |
CVE-2023-21417 | High | 7.1 | 2023-11-21 | Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversal attacks that allo… |
CVE-2023-21416 | High | 7.1 | 2023-11-21 | Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-Service attack allowing f… |
CVE-2023-21415 | Medium | 6.5 | 2023-10-16 | Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for fi… |
CVE-2023-39916 | Critical | 9.3 | 2023-09-13 | NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 as well as 0.14.0 up to and including 0.14.2 contains a possible path traversal vulnerability in the op… |
CVE-2023-32714 | High | 8.1 | 2023-06-01 | In the Splunk App for Lookup File Editing versions below 4.0.1, a low-privileged user can, with a specially crafted web request, trigger a path traversal explo… |
CVE-2022-48476 | High | 7.5 | 2023-04-24 | In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible |
CVE-2022-3693 | High | 7.5 | 2023-01-13 | Path Traversal vulnerability in Deytek Informatics FileOrbis File Management System allows Path Traversal. This issue affects FileOrbis File Management System… |
CVE-2022-36928 | Medium | 6.1 | 2023-01-09 | Zoom for Android clients before version 5.13.0 contain a path traversal vulnerability. A third party app could exploit this vulnerability to read and write to… |
CVE-2022-46826 | Medium | 6.2 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability. |
CVE-2022-2265 | High | 7.5 | 2022-09-21 | The Identity and Directory Management System developed by Çekino Bilgi Teknolojileri before version 2.1.25 has an unauthenticated Path traversal vulnerability… |
CVE-2022-24774 | High | 7.1 | 2022-03-22 | CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version… |
CVE-2021-1364 | Medium | 6.5 | 2021-01-20 | Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traver… |
CVE-2021-1357 | Medium | 6.5 | 2021-01-20 | Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traver… |
CVE-2021-1355 | Medium | 6.5 | 2021-01-20 | Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traver… |
CVE-2021-1282 | Medium | 6.5 | 2021-01-20 | Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traver… |
CVE-2020-27130 | Critical | 9.1 | 2020-11-17 | A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to… |
CVE-2018-3744 | Critical | 9.8 | 2018-05-29 | The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL. |