CWE-73 · External Control of File Name or Path (page 5)
Page 5 of 7 — CVEs classified under CWE-73, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-59511 | High | 7.8 | 2025-11-11 | External control of file name or path in Windows WLAN Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-20614 | Medium | 6.7 | 2025-11-11 | External control of file name or path for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalatio… |
CVE-2025-8998 | Low | 3.1 | 2025-11-11 | It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. This flaw can only be… |
CVE-2025-11451 | High | 7.5 | 2025-11-11 | The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to arbitrary files reads in all versions up to, and including, 5… |
CVE-2025-12915 | Medium | 6.4 | 2025-11-08 | A vulnerability was found in 70mai X200 up to 20251019. This issue affects some unknown processing of the component Init Script Handler. The manipulation resul… |
CVE-2025-64486 | | 2025-11-08 | calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker… | |
CVE-2025-12137 | Medium | 4.9 | 2025-11-01 | The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including… |
CVE-2020-36868 | High | 7.8 | 2025-10-30 | Nagios XI versions prior to 5.7.3 contain a privilege escalation vulnerability in the getprofile.sh helper script. The script performed profile retrieval and i… |
CVE-2025-62611 | | 2025-10-22 | aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local fi… | |
CVE-2025-8050 | Medium | 6.5 | 2025-10-21 | External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal. The vulnerability could allow a user to access files hosted on… |
CVE-2025-8048 | Medium | 6.5 | 2025-10-20 | External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal. The vulnerability could allow a user to submit a stored local fi… |
CVE-2025-11738 | Medium | 5.3 | 2025-10-18 | The Media Library Assistant plugin for WordPress is vulnerable to limited file reading in all versions up to, and including, 3.29 via the mla-stream-image.php… |
CVE-2025-62382 | High | 7.7 | 2025-10-15 | Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.2, Frigate's export workflow allows an authenticat… |
CVE-2025-59483 | Medium | 6.5 | 2025-10-15 | A validation vulnerability exists in an undisclosed URL in the Configuration utility. Note: Software versions which have reached End of Technical Support (EoT… |
CVE-2025-59292 | High | 8.2 | 2025-10-14 | External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally. |
CVE-2025-59291 | High | 8.2 | 2025-10-14 | External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally. |
CVE-2025-59244 | Medium | 6.5 | 2025-10-14 | External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-59200 | High | 7.7 | 2025-10-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Data Sharing Service Client allows an unauthorized attacker to p… |
CVE-2025-59185 | Medium | 6.5 | 2025-10-14 | External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-35053 | Medium | 6.4 | 2025-10-09 | Newforma Info Exchange (NIX) accepts requests to '/UserWeb/Common/MarkupServices.ashx' specifying the 'DownloadExportedPDF' command that allow an authenticated… |
CVE-2025-10494 | High | 8.1 | 2025-10-08 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation… |
CVE-2025-10306 | Low | 3.8 | 2025-10-03 | The Backup Bolt plugin for WordPress is vulnerable to arbitrary file downloads and backup location writes in all versions up to, and including, 1.4.1 via the p… |
CVE-2025-58769 | Low | 3.3 | 2025-10-01 | auth0-PHP is an SDK for Auth0 Authentication and Management APIs. In versions 3.3.0 through 8.16.0, the Bulk User Import endpoint in applications built with th… |
CVE-2025-6237 | Critical | 9.8 | 2025-09-18 | A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /api/v1/images/downlo… |
CVE-2025-10058 | High | 8.1 | 2025-09-17 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation… |
CVE-2025-8422 | High | 7.5 | 2025-09-11 | The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.7.6.7 via… |
CVE-2025-59049 | High | 7.5 | 2025-09-10 | Mockoon provides way to design and run mock APIs. Prior to version 9.2.0, a mock API configuration for static file serving follows the same approach presented… |
CVE-2025-58762 | Critical | 9.1 | 2025-09-09 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. In Tautulli v2.15.3 and earlier, an attacker with administrative access can use… |
CVE-2025-55316 | High | 7.8 | 2025-09-09 | External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally. |
CVE-2025-10134 | Critical | 9.1 | 2025-09-09 | The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone… |
CVE-2025-9920 | Medium | 4.7 | 2025-09-03 | A security flaw has been discovered in Campcodes Recruitment Management System 1.0. This impacts the function include of the file /admin/index.php. The manipul… |
CVE-2025-54945 | Critical | 9.8 | 2025-08-30 | An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary… |
CVE-2025-58158 | High | 8.8 | 2025-08-29 | Harness Open Source is an end-to-end developer platform with Source Control Management, CI/CD Pipelines, Hosted Developer Environments, and Artifact Registries… |
CVE-2024-13984 | | 2025-08-27 | QiAnXin TianQing Management Center versions up to and including 6.7.0.4130 contain a path traversal vulnerability in the rptsvr component that allows unauthent… | |
CVE-2025-9529 | High | 7.3 | 2025-08-27 | A weakness has been identified in Campcodes Payroll Management System 1.0. The affected element is the function include of the file /index.php. This manipulati… |
CVE-2025-9048 | High | 8.1 | 2025-08-23 | The Wptobe-memberships plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the del_img_ajax_call() functi… |
CVE-2025-53363 | | 2025-08-22 | dpanel is an open source server management panel written in Go. In versions 1.2.0 through 1.7.2, dpanel allows authenticated users to read arbitrary files from… | |
CVE-2025-55746 | Critical | 9.3 | 2025-08-20 | Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechan… |
CVE-2025-20269 | Medium | 6.5 | 2025-08-20 | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authen… |
CVE-2011-10030 | | 2025-08-20 | Foxit PDF Reader < 4.3.1.0218 exposes a JavaScript API function, createDataObject(), that allows untrusted PDF content to write arbitrary files anywhere on di… | |
CVE-2025-53769 | Medium | 5.5 | 2025-08-12 | External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally. |
CVE-2025-29866 | | 2025-08-07 | : External Control of File Name or Path vulnerability in TAGFREE X-Free Uploader XFU allows : Parameter Injection.This issue affects X-Free Uploader: from 1.0… | |
CVE-2025-54780 | High | 7.7 | 2025-08-05 | The glpi-screenshot-plugin allows users to take screenshots or screens recording directly from GLPI. In versions below 2.0.2, authenticated user can use the /a… |
CVE-2025-4674 | High | 8.6 | 2025-07-29 | The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present i… |
CVE-2025-5393 | Critical | 9.1 | 2025-07-15 | The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validati… |
CVE-2025-6691 | High | 8.1 | 2025-07-09 | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation… |
CVE-2025-48385 | | 2025-07-08 | Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to int… | |
CVE-2025-49760 | Low | 3.5 | 2025-07-08 | External control of file name or path in Windows Storage allows an authorized attacker to perform spoofing over a network. |
CVE-2025-49588 | | 2025-07-02 | Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In version 2.10.2, the server accepts links… | |
CVE-2025-6463 | High | 8.8 | 2025-07-02 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file… |
CVE-2025-33117 | Critical | 9.1 | 2025-06-19 | IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 could allow a privileged user to modify configuration files that would allow the upload of a malicious aut… |
CVE-2025-36506 | Medium | 6.5 | 2025-06-13 | External control of file name or path issue exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0. If an attacker sends a specially crafted requ… |
CVE-2024-1244 | | 2025-06-11 | Improper input validation in the OSSEC HIDS agent for Windows prior to version 3.8.0 allows an attacker in with control over the OSSEC server or in possession… | |
CVE-2024-1243 | High | 7.2 | 2025-06-11 | Improper input validation in the Wazuh agent for Windows prior to version 4.8.0 allows an attacker with control over the Wazuh server or agent key to configure… |
CVE-2025-47956 | Medium | 5.5 | 2025-06-10 | External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally. |
CVE-2025-33053 | High | 8.8 | 2025-06-10 | External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network. |
CVE-2025-48067 | Medium | 5.4 | 2025-06-10 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows a… |
CVE-2025-49138 | Medium | 6.5 | 2025-06-09 | HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, an authenticated Local File Inclusion (LFI) vulnerabil… |
CVE-2025-48783 | High | 7.5 | 2025-06-06 | An external control of file name or path vulnerability in the delete file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025… |
CVE-2025-48781 | High | 7.5 | 2025-06-06 | An external control of file name or path vulnerability in the download file function of Soar Cloud HRD Human Resource Management System through version 7.3.202… |
CVE-2025-32802 | Medium | 6.1 | 2025-05-28 | Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Many common configurations run Kea as ro… |
CVE-2025-4603 | Critical | 9.1 | 2025-05-24 | The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delet… |
CVE-2025-4602 | Medium | 5.9 | 2025-05-24 | The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Reads in all versions up to, and including, 1.2.5 via the get_… |
CVE-2024-51553 | Medium | 6.5 | 2025-05-22 | Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis iss… |
CVE-2025-2409 | Critical | 9.1 | 2025-05-22 | File corruption vulnerabilities in ASPECT provide attackers access to overwrite sys-tem files if session administrator credentials become compromised This issu… |
CVE-2025-3812 | High | 8.1 | 2025-05-17 | The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the qcld_openai_delet… |
CVE-2025-26646 | High | 8.0 | 2025-05-13 | External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a networ… |
CVE-2025-26684 | Medium | 6.7 | 2025-05-13 | External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally. |
CVE-2025-3419 | High | 7.5 | 2025-05-08 | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and inclu… |
CVE-2025-46762 | High | 8.1 | 2025-05-06 | Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced… |
CVE-2025-1056 | Medium | 6.1 | 2025-04-23 | Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the server is using. A non-admin user can m… |
CVE-2025-43951 | Critical | 9.8 | 2025-04-22 | LabVantage before LV 8.8.0.13 HF6 allows local file inclusion. Authenticated users can retrieve arbitrary files from the environment via the objectname request… |
CVE-2024-57394 | High | 8.8 | 2025-04-21 | The quarantine - restore function in Qi-ANXIN Tianqing Endpoint Security Management System v10.0 allows user to restore a malicious file to an arbitrary file p… |
CVE-2025-3103 | High | 7.5 | 2025-04-19 | The CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon plugin for WordPress is vulnerable to arbitrary file read due to… |
CVE-2025-29709 | Critical | 9.8 | 2025-04-16 | SourceCodester Company Website CMS 1.0 has a File upload vulnerability via the "Create portfolio" file /dashboard/portfolio. |
CVE-2025-29708 | Critical | 9.8 | 2025-04-16 | SourceCodester Company Website CMS 1.0 contains a file upload vulnerability via the "Create Services" file /dashboard/Services. |
CVE-2024-55372 | Critical | 9.8 | 2025-04-16 | Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by uploading a ZIP fil… |
CVE-2024-55371 | Critical | 9.8 | 2025-04-16 | Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file. T… |
CVE-2025-0124 | Low | 3.8 | 2025-04-11 | An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management… |
CVE-2025-29819 | Medium | 6.2 | 2025-04-08 | External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally. |
CVE-2025-3431 | High | 7.5 | 2025-04-08 | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.91… |
CVE-2025-2004 | Critical | 9.1 | 2025-04-08 | The Simple WP Events plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpe_delete_file AJAX action… |
CVE-2025-3033 | High | 7.7 | 2025-04-01 | After selecting a malicious Windows `.url` shortcut from the local filesystem, an unexpected file could be uploaded. *This bug only affects Firefox on Window… |
CVE-2025-2982 | Medium | 6.3 | 2025-03-31 | A vulnerability, which was classified as critical, was found in Legrand SMS PowerView 1.x. Affected is an unknown function. The manipulation of the argument re… |
CVE-2025-1911 | Low | 2.7 | 2025-03-26 | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient f… |
CVE-2025-27147 | High | 8.2 | 2025-03-25 | The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deployment, VMWare ESX hos… |
CVE-2024-10210 | | 2025-03-25 | An External Control of File Name or Path vulnerability in the APROL Web Portal used in B&R APROL <4.4-005P may allow an authenticated network-based attacker to… | |
CVE-2025-1972 | Low | 2.7 | 2025-03-22 | The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_l… |
CVE-2024-13922 | Low | 2.7 | 2025-03-20 | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the a… |
CVE-2025-0452 | High | 8.2 | 2025-03-20 | eosphoros-ai/DB-GPT version latest is vulnerable to arbitrary file deletion on Windows systems via the '/v1/agent/hub/update' endpoint. The application fails t… |
CVE-2024-8616 | High | 8.2 | 2025-03-20 | In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from th… |
CVE-2024-6829 | Critical | 9.1 | 2025-03-20 | A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the `tarfile.extractall()` function to extract the contents of a maliciously craft… |
CVE-2024-11042 | Critical | 9.1 | 2025-03-20 | In invoke-ai/invokeai version v5.0.2, the web API `POST /api/v1/images/delete` is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized… |
CVE-2024-10834 | Critical | 9.1 | 2025-03-20 | eosphoros-ai/db-gpt version 0.6.0 contains a vulnerability in the RAG-knowledge endpoint that allows for arbitrary file write. The issue arises from the abilit… |
CVE-2025-29930 | | 2025-03-18 | imFAQ is an advanced questions and answers management system for ImpressCMS. Prior to 1.0.1, if the $_GET['seoOp'] parameter is manipulated to include maliciou… | |
CVE-2023-45588 | High | 8.2 | 2025-03-14 | An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a loca… |
CVE-2025-24996 | Medium | 6.5 | 2025-03-11 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-24054 | Medium | 6.5 | 2025-03-11 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. |
CVE-2024-12036 | High | 7.5 | 2025-03-07 | The CS Framework plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.9 via the get_widget_settings_json() functio… |
CVE-2024-51961 | High | 7.5 | 2025-03-03 | There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could poten… |