CWE-552 · Files or Directories Accessible to External Parties (page 2)
Page 2 of 6 — CVEs classified under CWE-552, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-68109 | Critical | 9.1 | 2025-12-17 | ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file exte… |
CVE-2025-14697 | Low | 3.7 | 2025-12-15 | A security flaw has been discovered in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 4.10.24.3. Affected by this issue is some unknow… |
CVE-2025-14442 | Medium | 5.3 | 2025-12-12 | The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage of exported CSV file… |
CVE-2025-66625 | Medium | 4.9 | 2025-12-09 | Umbraco is an ASP.NET CMS. Due to unsafe handling and deletion of temporary files in versions 10.0.0 through 13.12.0, during the dictionary upload process an a… |
CVE-2025-12747 | Medium | 5.3 | 2025-11-21 | The Tainacan plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via uploaded files marked as private being… |
CVE-2025-12894 | Medium | 5.3 | 2025-11-21 | The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, an… |
CVE-2025-64185 | | 2025-11-20 | Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, Open OnDemand packages create world writable locations in the GEM_PATH. Open On… | |
CVE-2025-13225 | Medium | 5.6 | 2025-11-19 | Tanium addressed an arbitrary file deletion vulnerability in TanOS. |
CVE-2025-13200 | Medium | 5.3 | 2025-11-15 | A vulnerability was determined in SourceCodester Farm Management System 1.0. Affected by this vulnerability is an unknown functionality. This manipulation caus… |
CVE-2021-4463 | | 2025-11-12 | Longjing Technology BEMS API versions up to and including 1.21 contains an unauthenticated arbitrary file download vulnerability in the 'downloads' endpoint. T… | |
CVE-2025-11959 | High | 8.1 | 2025-11-11 | Files or Directories Accessible to External Parties, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Premierturk Information… |
CVE-2025-33150 | Medium | 5.3 | 2025-11-10 | IBM Cognos Analytics Certified Containers 12.1.0 could disclose package parameter information due to the presence of hidden pages. |
CVE-2025-58152 | Medium | 5.3 | 2025-10-31 | FutureNet MA and IP-K series provided by Century Systems Co., Ltd. put the firmware version and the garbage collection information on the internal web page. Wi… |
CVE-2025-11965 | High | 7.5 | 2025-10-22 | In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails to restrict access to… |
CVE-2025-31996 | Medium | 5.3 | 2025-10-13 | HCL Unica Platform is affected by unprotected files due to improper access controls. These files may contain sensitive information such as private or system… |
CVE-2025-11371 | High | 7.5 | 2025-10-09 | In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended… |
CVE-2025-59976 | Medium | 6.5 | 2025-10-09 | An arbitrary file download vulnerability in the web interface of Juniper Networks Junos Space allows a network-based authenticated attacker using a crafted GET… |
CVE-2025-61734 | High | 7.5 | 2025-10-02 | Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well… |
CVE-2025-37130 | Medium | 6.5 | 2025-09-16 | A vulnerability in the command-line interface of EdgeConnect SD-WAN could allow an authenticated attacker to read arbitrary files within the system. Successful… |
CVE-2025-3025 | High | 7.3 | 2025-09-15 | Elevation of Privileges in the cleaning feature of Gen Digital CCleaner version 6.33.11465 on Windows allows a local user to gain SYSTEM privileges via exploit… |
CVE-2025-59054 | | 2025-09-12 | dstack is a software development kit (SDK) to simplify the deployment of arbitrary containerized apps into trusted execution environments. In versions of dstac… | |
CVE-2025-58753 | High | 7.5 | 2025-09-09 | Copyparty is a portable file server. In versions prior to 1.19.8, there was a missing permission-check in the shares feature (the `shr` global-option). When a… |
CVE-2025-9273 | Medium | 4.3 | 2025-09-02 | CData API Server MySQL Misconfiguration Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on a… |
CVE-2025-52460 | Medium | 5.3 | 2025-08-28 | Files or directories accessible to external parties issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If exploited, uploaded f… |
CVE-2025-43758 | Medium | 5.3 | 2025-08-22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 throu… |
CVE-2025-51818 | Medium | 5.4 | 2025-08-21 | MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component. This allows an attacker to execute arbitrary commands |
CVE-2009-10005 | | 2025-08-20 | ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 expose the mimencode binary via a CGI endpoint, allowing unauthenticat… | |
CVE-2025-43749 | Medium | 5.3 | 2025-08-20 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 throu… |
CVE-2025-44779 | Medium | 6.6 | 2025-08-07 | An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull. |
CVE-2025-23276 | High | 7.8 | 2025-08-02 | NVIDIA Installer for Windows contains a vulnerability where an attacker may be able to escalate privileges. A successful exploit of this vulnerability may lead… |
CVE-2025-30103 | Medium | 5.5 | 2025-07-30 | Dell SmartFabric OS10 Software, versions prior to 10.6.0.5 contains a Files or Directories Accessible to External Parties vulnerability. A low privileged attac… |
CVE-2025-34139 | | 2025-07-25 | A vulnerability exists in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud that could allow an unauthent… | |
CVE-2025-41240 | Critical | 10.0 | 2025-07-24 | Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path (/opt/bitnami/*/secrets) that is located within the web server document root. In af… |
CVE-2023-41566 | High | 8.1 | 2025-07-17 | OA EKP v16 was discovered to contain an arbitrary download vulnerability via the component /ui/sys_ui_extend/sysUiExtend.do. This vulnerability allows attacker… |
CVE-2025-34110 | | 2025-07-15 | A directory traversal vulnerability exists in ColoradoFTP Server ≤ 1.3 Build 8 for Windows, allowing unauthenticated attackers to read or write arbitrary files… | |
CVE-2025-53536 | High | 8.1 | 2025-07-07 | Roo Code is an AI-powered autonomous coding agent. Prior to 3.22.6, if the victim had "Write" auto-approved, an attacker with the ability to submit prompts to… |
CVE-2025-49797 | High | 7.8 | 2025-06-25 | Multiple Brother driver installers for Windows contain a privilege escalation vulnerability. If exploited, an arbitrary program may be executed with the admini… |
CVE-2024-56731 | Critical | 10.0 | 2025-06-24 | Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote comman… |
CVE-2025-0620 | Medium | 4.9 | 2025-06-06 | A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expo… |
CVE-2025-40908 | Critical | 9.1 | 2025-06-01 | YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified |
CVE-2025-4634 | Medium | 4.1 | 2025-05-30 | The web portal on airpointer 2.4.107-2 was vulnerable local file inclusion. A malicious user with administrative privileges in the web portal would be able to… |
CVE-2025-5273 | Medium | 6.5 | 2025-05-29 | Versions of the package mcp-markdownify-server before 1.0.0 are vulnerable to Files or Directories Accessible to External Parties via the get-markdown-file too… |
CVE-2025-48928 | Medium | 4.0 | 2025-05-28 | The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password p… |
CVE-2025-4134 | High | 7.3 | 2025-05-28 | Lack of file validation in do_update_vps in Avast Business Antivirus for Linux 4.5 on Linux allows local user to spoof or tamper with the update file via an un… |
CVE-2025-45529 | High | 7.1 | 2025-05-27 | An arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbitrary files via sending a crafted GET re… |
CVE-2025-4909 | High | 7.3 | 2025-05-19 | A vulnerability classified as critical was found in SourceCodester Client Database Management System 1.0. This vulnerability affects unknown code. The manipula… |
CVE-2025-4807 | Medium | 5.3 | 2025-05-16 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Student Clearance System 1.0. This affects an unknown part. The manipu… |
CVE-2024-8031 | Medium | 6.5 | 2025-05-15 | The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authentic… |
CVE-2025-21264 | High | 7.1 | 2025-05-13 | Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
CVE-2024-4981 | High | 7.6 | 2025-05-12 | A vulnerability was discovered in Pagure server. If a malicious user were to submit a git repository with symbolic links, the server could unintentionally show… |
CVE-2025-32819 | High | 8.8 | 2025-05-07 | A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete an arbitrary file p… |
CVE-2025-1982 | | 2025-04-16 | Local File Inclusion vulnerability in Ready's attachment upload panel allows low privileged user to provide link to a local file using the file:// protocol thu… | |
CVE-2025-2222 | High | 7.8 | 2025-04-09 | CWE-552: Files or Directories Accessible to External Parties vulnerability over https exists that could leak information and potential privilege escalation fol… |
CVE-2025-27147 | High | 8.2 | 2025-03-25 | The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deployment, VMWare ESX hos… |
CVE-2025-2652 | Medium | 5.3 | 2025-03-23 | A vulnerability has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this vulnerabilit… |
CVE-2025-2651 | Medium | 5.3 | 2025-03-23 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /oews/ad… |
CVE-2024-13126 | Medium | 4.6 | 2025-03-16 | The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of f… |
CVE-2025-22369 | | 2025-03-11 | The ReadFile endpoint of the firmware for Mennekes Smart / Premium Chargingpoints can be abused to read arbitrary files from the underlying OS. | |
CVE-2025-25267 | Medium | 6.2 | 2025-03-11 | A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0… |
CVE-2025-25266 | Medium | 6.8 | 2025-03-11 | A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0… |
CVE-2025-2147 | Medium | 5.3 | 2025-03-10 | A vulnerability was found in Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System 1.0. It has been classified as prob… |
CVE-2024-48864 | Critical | 9.1 | 2025-03-07 | A files or directories accessible to external parties vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow rem… |
CVE-2025-2038 | High | 7.3 | 2025-03-06 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the f… |
CVE-2025-25759 | High | 7.5 | 2025-02-27 | An issue in the component admin_template.php of SUCMS v1.0 allows attackers to execute a directory traversal and arbitrary file deletion via a crafted GET requ… |
CVE-2025-25799 | Medium | 6.0 | 2025-02-26 | SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe.php. |
CVE-2025-26525 | High | 8.6 | 2025-02-24 | Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live in… |
CVE-2024-12917 | High | 8.3 | 2025-02-24 | Files or Directories Accessible to External Parties vulnerability in Agito Computer Health4All allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-23421 | Medium | 6.4 | 2025-02-13 | An attacker could obtain firmware files and reverse engineer their intended use leading to loss of confidentiality and integrity of the hardware devices enab… |
CVE-2024-11629 | High | 7.1 | 2025-02-12 | In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), using .NET Standard 2.0, the contents of a file at an arbitrary pa… |
CVE-2025-1042 | Medium | 4.9 | 2025-02-12 | An insecure direct object reference vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2… |
CVE-2025-0509 | High | 7.3 | 2025-02-04 | A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA… |
CVE-2024-48019 | Medium | 5.4 | 2025-02-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Files or Directories Accessible to External Parties vulnerability in Apache Dor… |
CVE-2024-57452 | High | 7.5 | 2025-02-03 | ChestnutCMS <=1.5.0 has an arbitrary file deletion vulnerability in contentcore.controller.FileController, which allows attackers to delete any file and folder. |
CVE-2023-29080 | | 2025-01-30 | Potential privilege escalation vulnerability in Revenera InstallShield versions 2022 R2 and 2021 R2 due to adding InstallScript custom action to a Basic MSI or… | |
CVE-2024-47106 | Medium | 5.3 | 2025-01-18 | IBM Jazz for Service Management 1.1.3 through 1.1.3.22 could allow a remote attacker to obtain sensitive information from improper access restrictions that cou… |
CVE-2024-45627 | Medium | 5.9 | 2025-01-14 | In Apache Linkis <1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manage… |
CVE-2024-53649 | Medium | 6.5 | 2025-01-14 | A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.80), SIPROTEC 5 6MD85 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 6M… |
CVE-2024-47518 | Medium | 6.4 | 2025-01-10 | Specially constructed queries targeting ETM could discover active remote access sessions |
CVE-2024-43660 | High | 7.5 | 2025-01-09 | The CGI script <redacted>.sh can be used to download any file on the filesystem. This issue affects Iocharger firmware for AC model chargers beforeversion 241… |
CVE-2025-21609 | Critical | 9.1 | 2025-01-03 | SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnera… |
CVE-2024-52047 | High | 7.5 | 2024-12-31 | A widget local file inclusion vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations. Pleas… |
CVE-2024-9945 | Medium | 5.3 | 2024-12-13 | An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in ce… |
CVE-2024-54099 | Medium | 6.7 | 2024-12-12 | File replacement vulnerability on some devices Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality. |
CVE-2024-50627 | High | 8.8 | 2024-12-09 | An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Privilege Escalation vulnerability exists in the file upload feature. It allows an attacker on… |
CVE-2024-51542 | High | 8.2 | 2024-12-05 | Configuration Download vulnerabilities allow access to dependency configuration information. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Ser… |
CVE-2024-53676 | Critical | 9.8 | 2024-11-27 | A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution. |
CVE-2024-51058 | Medium | 6.2 | 2024-11-26 | Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user to read arbitrary files from the server's file s… |
CVE-2024-10403 | High | 7.5 | 2024-11-21 | Brocade Fabric OS versions before 8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a can capture the SFTP/FTP server password used for a firmwa… |
CVE-2024-10126 | Medium | 4.3 | 2024-11-20 | Local File Inclusion vulnerability in M-Files Server in versions before 24.11 (excluding 24.8 SR1, 24.2 SR3 and 23.8 SR7) allows an authenticated user to read… |
CVE-2024-31141 | Medium | 6.5 | 2024-11-19 | Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configur… |
CVE-2023-20039 | Medium | 5.5 | 2024-11-15 | A vulnerability in Cisco IND could allow an authenticated, local attacker to read application data. This vulnerability is due to insufficient default file p… |
CVE-2024-52292 | High | 7.7 | 2024-11-13 | Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This f… |
CVE-2024-8535 | High | 8.1 | 2024-11-12 | Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway (SSL VPN, IC… |
CVE-2024-48838 | Low | 3.3 | 2024-11-12 | Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) a Files or Directories Accessible to External Parties vulnerabili… |
CVE-2024-10526 | | 2024-11-07 | Rapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITE_DACL permission to… | |
CVE-2024-48647 | High | 7.2 | 2024-10-30 | A file disclosure vulnerability exists in Sage 1000 v7.0.0. This vulnerability allows remote attackers to retrieve arbitrary files from the server's file syste… |
CVE-2024-49359 | High | 7.5 | 2024-10-24 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint `http… |
CVE-2024-49756 | Medium | 5.3 | 2024-10-23 | AshPostgres is the PostgreSQL data layer for Ash Framework. Starting in version 2.0.0 and prior to version 2.4.10, in certain very specific situations, it was… |
CVE-2024-44807 | Medium | 5.3 | 2024-10-11 | A directory listing issue in the baserCMS plugin in D-ZERO CO., LTD. BurgerEditor and BurgerEditor Limited Edition before 2.25.1 allows remote attackers to obt… |
CVE-2024-45894 | Medium | 4.9 | 2024-10-07 | BlueCMS 1.6 suffers from Arbitrary File Deletion via the file_name parameter in an /admin/database.php?act=del request. |