CWE-73 · External Control of File Name or Path (page 4)
Page 4 of 6 — CVEs classified under CWE-73, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9048 | High | 8.1 | 2025-08-23 | The Wptobe-memberships plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the del_img_ajax_call() functi… |
CVE-2025-53363 | | 2025-08-22 | dpanel is an open source server management panel written in Go. In versions 1.2.0 through 1.7.2, dpanel allows authenticated users to read arbitrary files from… | |
CVE-2025-55746 | Critical | 9.3 | 2025-08-20 | Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechan… |
CVE-2025-20269 | Medium | 6.5 | 2025-08-20 | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authen… |
CVE-2011-10030 | | 2025-08-20 | Foxit PDF Reader < 4.3.1.0218 exposes a JavaScript API function, createDataObject(), that allows untrusted PDF content to write arbitrary files anywhere on di… | |
CVE-2025-53769 | Medium | 5.5 | 2025-08-12 | External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally. |
CVE-2025-29866 | | 2025-08-07 | : External Control of File Name or Path vulnerability in TAGFREE X-Free Uploader XFU allows : Parameter Injection.This issue affects X-Free Uploader: from 1.0… | |
CVE-2025-54780 | High | 7.7 | 2025-08-05 | The glpi-screenshot-plugin allows users to take screenshots or screens recording directly from GLPI. In versions below 2.0.2, authenticated user can use the /a… |
CVE-2025-4674 | High | 8.6 | 2025-07-29 | The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present i… |
CVE-2025-5393 | Critical | 9.1 | 2025-07-15 | The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validati… |
CVE-2025-6691 | High | 8.1 | 2025-07-09 | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation… |
CVE-2025-48385 | | 2025-07-08 | Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to int… | |
CVE-2025-49760 | Low | 3.5 | 2025-07-08 | External control of file name or path in Windows Storage allows an authorized attacker to perform spoofing over a network. |
CVE-2025-49588 | | 2025-07-02 | Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In version 2.10.2, the server accepts links… | |
CVE-2025-6463 | High | 8.8 | 2025-07-02 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file… |
CVE-2025-33117 | Critical | 9.1 | 2025-06-19 | IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 could allow a privileged user to modify configuration files that would allow the upload of a malicious aut… |
CVE-2025-36506 | Medium | 6.5 | 2025-06-13 | External control of file name or path issue exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0. If an attacker sends a specially crafted requ… |
CVE-2024-1244 | | 2025-06-11 | Improper input validation in the OSSEC HIDS agent for Windows prior to version 3.8.0 allows an attacker in with control over the OSSEC server or in possession… | |
CVE-2024-1243 | High | 7.2 | 2025-06-11 | Improper input validation in the Wazuh agent for Windows prior to version 4.8.0 allows an attacker with control over the Wazuh server or agent key to configure… |
CVE-2025-47956 | Medium | 5.5 | 2025-06-10 | External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally. |
CVE-2025-33053 | High | 8.8 | 2025-06-10 | External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network. |
CVE-2025-48067 | Medium | 5.4 | 2025-06-10 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows a… |
CVE-2025-49138 | Medium | 6.5 | 2025-06-09 | HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, an authenticated Local File Inclusion (LFI) vulnerabil… |
CVE-2025-48783 | High | 7.5 | 2025-06-06 | An external control of file name or path vulnerability in the delete file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025… |
CVE-2025-48781 | High | 7.5 | 2025-06-06 | An external control of file name or path vulnerability in the download file function of Soar Cloud HRD Human Resource Management System through version 7.3.202… |
CVE-2025-32802 | Medium | 6.1 | 2025-05-28 | Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Many common configurations run Kea as ro… |
CVE-2025-4603 | Critical | 9.1 | 2025-05-24 | The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delet… |
CVE-2025-4602 | Medium | 5.9 | 2025-05-24 | The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Reads in all versions up to, and including, 1.2.5 via the get_… |
CVE-2024-51553 | Medium | 6.5 | 2025-05-22 | Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis iss… |
CVE-2025-2409 | Critical | 9.1 | 2025-05-22 | File corruption vulnerabilities in ASPECT provide attackers access to overwrite sys-tem files if session administrator credentials become compromised This issu… |
CVE-2025-3812 | High | 8.1 | 2025-05-17 | The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the qcld_openai_delet… |
CVE-2025-26646 | High | 8.0 | 2025-05-13 | External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a networ… |
CVE-2025-26684 | Medium | 6.7 | 2025-05-13 | External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally. |
CVE-2025-3419 | High | 7.5 | 2025-05-08 | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and inclu… |
CVE-2025-46762 | High | 8.1 | 2025-05-06 | Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced… |
CVE-2025-1056 | Medium | 6.1 | 2025-04-23 | Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the server is using. A non-admin user can m… |
CVE-2025-43951 | Critical | 9.8 | 2025-04-22 | LabVantage before LV 8.8.0.13 HF6 allows local file inclusion. Authenticated users can retrieve arbitrary files from the environment via the objectname request… |
CVE-2024-57394 | High | 8.8 | 2025-04-21 | The quarantine - restore function in Qi-ANXIN Tianqing Endpoint Security Management System v10.0 allows user to restore a malicious file to an arbitrary file p… |
CVE-2025-3103 | High | 7.5 | 2025-04-19 | The CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon plugin for WordPress is vulnerable to arbitrary file read due to… |
CVE-2025-29709 | Critical | 9.8 | 2025-04-16 | SourceCodester Company Website CMS 1.0 has a File upload vulnerability via the "Create portfolio" file /dashboard/portfolio. |
CVE-2025-29708 | Critical | 9.8 | 2025-04-16 | SourceCodester Company Website CMS 1.0 contains a file upload vulnerability via the "Create Services" file /dashboard/Services. |
CVE-2024-55372 | Critical | 9.8 | 2025-04-16 | Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by uploading a ZIP fil… |
CVE-2024-55371 | Critical | 9.8 | 2025-04-16 | Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file. T… |
CVE-2025-0124 | Low | 3.8 | 2025-04-11 | An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management… |
CVE-2025-29819 | Medium | 6.2 | 2025-04-08 | External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally. |
CVE-2025-3431 | High | 7.5 | 2025-04-08 | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.91… |
CVE-2025-2004 | Critical | 9.1 | 2025-04-08 | The Simple WP Events plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpe_delete_file AJAX action… |
CVE-2025-3033 | High | 7.7 | 2025-04-01 | After selecting a malicious Windows `.url` shortcut from the local filesystem, an unexpected file could be uploaded. *This bug only affects Firefox on Window… |
CVE-2025-2982 | Medium | 6.3 | 2025-03-31 | A vulnerability, which was classified as critical, was found in Legrand SMS PowerView 1.x. Affected is an unknown function. The manipulation of the argument re… |
CVE-2025-1911 | Low | 2.7 | 2025-03-26 | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient f… |
CVE-2025-27147 | High | 8.2 | 2025-03-25 | The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deployment, VMWare ESX hos… |
CVE-2024-10210 | | 2025-03-25 | An External Control of File Name or Path vulnerability in the APROL Web Portal used in B&R APROL <4.4-005P may allow an authenticated network-based attacker to… | |
CVE-2025-1972 | Low | 2.7 | 2025-03-22 | The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_l… |
CVE-2024-13922 | Low | 2.7 | 2025-03-20 | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the a… |
CVE-2025-0452 | High | 8.2 | 2025-03-20 | eosphoros-ai/DB-GPT version latest is vulnerable to arbitrary file deletion on Windows systems via the '/v1/agent/hub/update' endpoint. The application fails t… |
CVE-2024-8616 | High | 8.2 | 2025-03-20 | In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from th… |
CVE-2024-6829 | Critical | 9.1 | 2025-03-20 | A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the `tarfile.extractall()` function to extract the contents of a maliciously craft… |
CVE-2024-11042 | Critical | 9.1 | 2025-03-20 | In invoke-ai/invokeai version v5.0.2, the web API `POST /api/v1/images/delete` is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized… |
CVE-2024-10834 | Critical | 9.1 | 2025-03-20 | eosphoros-ai/db-gpt version 0.6.0 contains a vulnerability in the RAG-knowledge endpoint that allows for arbitrary file write. The issue arises from the abilit… |
CVE-2025-29930 | | 2025-03-18 | imFAQ is an advanced questions and answers management system for ImpressCMS. Prior to 1.0.1, if the $_GET['seoOp'] parameter is manipulated to include maliciou… | |
CVE-2023-45588 | High | 8.2 | 2025-03-14 | An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a loca… |
CVE-2025-24996 | Medium | 6.5 | 2025-03-11 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-24054 | Medium | 6.5 | 2025-03-11 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. |
CVE-2024-12036 | High | 7.5 | 2025-03-07 | The CS Framework plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.9 via the get_widget_settings_json() functio… |
CVE-2024-51961 | High | 7.5 | 2025-03-03 | There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could poten… |
CVE-2025-1730 | Medium | 6.5 | 2025-03-01 | The Simple Download Counter plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.0 via the 'simple_download_counte… |
CVE-2025-25478 | Medium | 6.5 | 2025-02-28 | The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. This mismanagement leads to the disclosure of… |
CVE-2025-25761 | High | 7.2 | 2025-02-27 | HkCms v2.3.2.240702 was discovered to contain an arbitrary file write vulnerability in the component Appcenter.php. |
CVE-2025-1686 | Medium | 6.8 | 2025-02-27 | Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the include tag. A high p… |
CVE-2025-27137 | Medium | 4.4 | 2025-02-24 | Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track allows u… |
CVE-2024-22341 | Medium | 5.3 | 2025-02-22 | IBM Watson Query on Cloud Pak for Data 4.0.0 through 4.0.9, 4.5.0 through 4.5.3, 4.6.0 through 4.6.6, 4.7.0 through 4.7.4, and 4.8.0 through 4.8.7 could allow… |
CVE-2024-38657 | Medium | 4.9 | 2025-02-21 | External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated… |
CVE-2024-47265 | Medium | 6.5 | 2025-02-13 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in encrypted share umount functionality in Synology Active Backup… |
CVE-2025-0111 | Medium | 6.5 | 2025-02-12 | An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web… |
CVE-2025-0109 | | 2025-02-12 | An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attacker with network acces… | |
CVE-2025-21377 | Medium | 6.5 | 2025-02-11 | NTLM Hash Disclosure Spoofing Vulnerability |
CVE-2024-12058 | Medium | 6.8 | 2025-02-11 | External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated… |
CVE-2025-0630 | Medium | 6.5 | 2025-02-04 | Multiple Western Telematic (WTI) products contain a web interface that is vulnerable to a local file inclusion attack (LFI), where any authenticated user has p… |
CVE-2024-12267 | Medium | 5.3 | 2025-01-31 | The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited arbitrary file deletion due to insufficient file path val… |
CVE-2024-12861 | Medium | 6.5 | 2025-01-30 | The W2S – Migrate WooCommerce to Shopify plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.2.1 via the 'viw2s_v… |
CVE-2025-0851 | Critical | 9.8 | 2025-01-29 | A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary location… |
CVE-2025-0105 | Critical | 9.1 | 2025-01-11 | An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files accessible to the www-d… |
CVE-2024-43658 | | 2025-01-09 | Patch traversal, External Control of File Name or Path vulnerability in Iocharger Home allows deletion of arbitrary files This issue affects Iocharger firmwar… | |
CVE-2025-0211 | Medium | 6.3 | 2025-01-04 | A vulnerability was found in Campcodes School Faculty Scheduling System 1.0 and classified as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-0202 | Medium | 5.5 | 2025-01-04 | A vulnerability was found in TCS BaNCS 10. It has been classified as problematic. This affects an unknown part of the file /REPORTS/REPORTS_SHOW_FILE.jsp. The… |
CVE-2024-12875 | Medium | 4.9 | 2024-12-21 | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all versions up to, an… |
CVE-2024-12066 | High | 8.8 | 2024-12-21 | The SMSA Shipping(official) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the smsa_delete_label() f… |
CVE-2024-4230 | High | 7.8 | 2024-12-19 | External Control of File Name or Path vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers… |
CVE-2024-11838 | Critical | 9.8 | 2024-12-13 | External Control of File Name or Path vulnerability in PlexTrac allows Local Code Inclusion through use of an undocumented API endpoint.This issue affects Plex… |
CVE-2024-12357 | Medium | 4.3 | 2024-12-09 | A vulnerability was found in SourceCodester Best House Rental Management System 1.0 and classified as problematic. Affected by this issue is some unknown funct… |
CVE-2024-46909 | Critical | 9.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage this vulnerability to execute code in the context of the se… |
CVE-2024-10492 | Low | 2.7 | 2024-11-25 | A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context… |
CVE-2024-43451 | Medium | 6.5 | 2024-11-12 | NTLM Hash Disclosure Spoofing Vulnerability |
CVE-2024-10672 | Low | 2.7 | 2024-11-12 | The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the mpg_upse… |
CVE-2023-5816 | Medium | 4.9 | 2024-10-30 | The Code Explorer plugin for WordPress is vulnerable to arbitrary external file reading in all versions up to, and including, 1.4.5. This is due to the fact th… |
CVE-2024-5823 | Critical | 9.1 | 2024-10-29 | A file overwrite vulnerability exists in gaizhenbiao/chuanhuchatgpt versions <= 20240410. This vulnerability allows an attacker to gain unauthorized access to… |
CVE-2024-41183 | High | 7.8 | 2024-10-22 | Trend Micro VPN, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite under specific conditions that can lead to elevation of privileges. |
CVE-2024-9575 | | 2024-10-09 | Local File Inclusion vulnerability in pretix Widget WordPress plugin pretix-widget on Windows allows PHP Local File Inclusion. This issue affects pretix Widget… | |
CVE-2024-43615 | High | 7.1 | 2024-10-08 | Microsoft OpenSSH for Windows Remote Code Execution Vulnerability |
CVE-2024-43581 | High | 7.1 | 2024-10-08 | Microsoft OpenSSH for Windows Remote Code Execution Vulnerability |