CWE-73 · External Control of File Name or Path (page 6)
Page 6 of 7 — CVEs classified under CWE-73, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1730 | Medium | 6.5 | 2025-03-01 | The Simple Download Counter plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.0 via the 'simple_download_counte… |
CVE-2025-25478 | Medium | 6.5 | 2025-02-28 | The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. This mismanagement leads to the disclosure of… |
CVE-2025-25761 | High | 7.2 | 2025-02-27 | HkCms v2.3.2.240702 was discovered to contain an arbitrary file write vulnerability in the component Appcenter.php. |
CVE-2025-1686 | Medium | 6.8 | 2025-02-27 | Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the include tag. A high p… |
CVE-2025-27137 | Medium | 4.4 | 2025-02-24 | Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track allows u… |
CVE-2024-22341 | Medium | 5.3 | 2025-02-22 | IBM Watson Query on Cloud Pak for Data 4.0.0 through 4.0.9, 4.5.0 through 4.5.3, 4.6.0 through 4.6.6, 4.7.0 through 4.7.4, and 4.8.0 through 4.8.7 could allow… |
CVE-2024-38657 | Medium | 4.9 | 2025-02-21 | External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated… |
CVE-2024-47265 | Medium | 6.5 | 2025-02-13 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in encrypted share umount functionality in Synology Active Backup… |
CVE-2025-0111 | Medium | 6.5 | 2025-02-12 | An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web… |
CVE-2025-0109 | | 2025-02-12 | An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attacker with network acces… | |
CVE-2025-21377 | Medium | 6.5 | 2025-02-11 | NTLM Hash Disclosure Spoofing Vulnerability |
CVE-2024-12058 | Medium | 6.8 | 2025-02-11 | External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated… |
CVE-2025-0630 | Medium | 6.5 | 2025-02-04 | Multiple Western Telematic (WTI) products contain a web interface that is vulnerable to a local file inclusion attack (LFI), where any authenticated user has p… |
CVE-2024-12267 | Medium | 5.3 | 2025-01-31 | The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited arbitrary file deletion due to insufficient file path val… |
CVE-2024-12861 | Medium | 6.5 | 2025-01-30 | The W2S – Migrate WooCommerce to Shopify plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.2.1 via the 'viw2s_v… |
CVE-2025-0851 | Critical | 9.8 | 2025-01-29 | A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary location… |
CVE-2025-0105 | Critical | 9.1 | 2025-01-11 | An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files accessible to the www-d… |
CVE-2024-43658 | | 2025-01-09 | Patch traversal, External Control of File Name or Path vulnerability in Iocharger Home allows deletion of arbitrary files This issue affects Iocharger firmwar… | |
CVE-2025-0211 | Medium | 6.3 | 2025-01-04 | A vulnerability was found in Campcodes School Faculty Scheduling System 1.0 and classified as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-0202 | Medium | 5.5 | 2025-01-04 | A vulnerability was found in TCS BaNCS 10. It has been classified as problematic. This affects an unknown part of the file /REPORTS/REPORTS_SHOW_FILE.jsp. The… |
CVE-2024-12875 | Medium | 4.9 | 2024-12-21 | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all versions up to, an… |
CVE-2024-12066 | High | 8.8 | 2024-12-21 | The SMSA Shipping(official) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the smsa_delete_label() f… |
CVE-2024-4230 | High | 7.8 | 2024-12-19 | External Control of File Name or Path vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers… |
CVE-2024-11838 | Critical | 9.8 | 2024-12-13 | External Control of File Name or Path vulnerability in PlexTrac allows Local Code Inclusion through use of an undocumented API endpoint.This issue affects Plex… |
CVE-2024-12357 | Medium | 4.3 | 2024-12-09 | A vulnerability was found in SourceCodester Best House Rental Management System 1.0 and classified as problematic. Affected by this issue is some unknown funct… |
CVE-2024-46909 | Critical | 9.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage this vulnerability to execute code in the context of the se… |
CVE-2024-10492 | Low | 2.7 | 2024-11-25 | A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context… |
CVE-2024-43451 | Medium | 6.5 | 2024-11-12 | NTLM Hash Disclosure Spoofing Vulnerability |
CVE-2024-10672 | Low | 2.7 | 2024-11-12 | The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the mpg_upse… |
CVE-2023-5816 | Medium | 4.9 | 2024-10-30 | The Code Explorer plugin for WordPress is vulnerable to arbitrary external file reading in all versions up to, and including, 1.4.5. This is due to the fact th… |
CVE-2024-5823 | Critical | 9.1 | 2024-10-29 | A file overwrite vulnerability exists in gaizhenbiao/chuanhuchatgpt versions <= 20240410. This vulnerability allows an attacker to gain unauthorized access to… |
CVE-2024-41183 | High | 7.8 | 2024-10-22 | Trend Micro VPN, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite under specific conditions that can lead to elevation of privileges. |
CVE-2024-9575 | | 2024-10-09 | Local File Inclusion vulnerability in pretix Widget WordPress plugin pretix-widget on Windows allows PHP Local File Inclusion. This issue affects pretix Widget… | |
CVE-2024-43615 | High | 7.1 | 2024-10-08 | Microsoft OpenSSH for Windows Remote Code Execution Vulnerability |
CVE-2024-43581 | High | 7.1 | 2024-10-08 | Microsoft OpenSSH for Windows Remote Code Execution Vulnerability |
CVE-2024-38029 | High | 7.5 | 2024-10-08 | Microsoft OpenSSH for Windows Remote Code Execution Vulnerability |
CVE-2024-38040 | High | 7.5 | 2024-10-04 | There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that co… |
CVE-2024-9275 | Medium | 6.3 | 2024-09-27 | A vulnerability was found in jeanmarc77 123solar up to 1.8.4.5. It has been rated as critical. This issue affects some unknown processing of the file /admin/ad… |
CVE-2024-9142 | Critical | 9.8 | 2024-09-25 | External Control of File Name or Path, : Incorrect Permission Assignment for Critical Resource vulnerability in Olgu Computer Systems e-Belediye allows Manipul… |
CVE-2024-21545 | High | 8.2 | 2024-09-25 | Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization. Insufficient safeguards against malicious API response… |
CVE-2024-7626 | High | 8.1 | 2024-09-11 | The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file movement and reading due t… |
CVE-2024-8517 | Critical | 9.8 | 2024-09-06 | SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating syste… |
CVE-2024-7744 | Medium | 6.5 | 2024-08-28 | In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Web T… |
CVE-2024-7911 | Medium | 6.3 | 2024-08-18 | A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of the file /sim… |
CVE-2024-38173 | Medium | 6.7 | 2024-08-13 | Microsoft Outlook Remote Code Execution Vulnerability |
CVE-2024-38165 | Medium | 6.5 | 2024-08-13 | Windows Compressed Folder Tampering Vulnerability |
CVE-2024-7497 | Medium | 6.3 | 2024-08-06 | A vulnerability was found in itsourcecode Airline Reservation System 1.0 and classified as critical. This issue affects some unknown processing of the file /ad… |
CVE-2024-7496 | Medium | 6.3 | 2024-08-06 | A vulnerability has been found in itsourcecode Airline Reservation System 1.0 and classified as critical. This vulnerability affects unknown code of the file /… |
CVE-2024-6714 | High | 8.8 | 2024-07-23 | An issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local attacker to escalate their privilege. |
CVE-2024-6937 | Low | 2.7 | 2024-07-21 | A vulnerability, which was classified as problematic, was found in formtools.org Form Tools 3.1.1. Affected is the function curl_exec of the file /admin/forms/… |
CVE-2024-6467 | High | 8.8 | 2024-07-17 | The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to Arbitrary File Read to Arbitrary File… |
CVE-2024-39904 | High | 8.8 | 2024-07-11 | VNote is a note-taking platform. Prior to 3.18.1, a code execution vulnerability existed in VNote, which allowed an attacker to execute arbitrary programs on t… |
CVE-2024-23317 | Medium | 6.3 | 2024-07-11 | External Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the Controller to perform arb… |
CVE-2024-37149 | High | 7.2 | 2024-07-10 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authentic… |
CVE-2024-38049 | Medium | 6.6 | 2024-07-09 | Windows Distributed Transaction Coordinator Remote Code Execution Vulnerability |
CVE-2024-39303 | Medium | 4.4 | 2024-07-01 | Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible… |
CVE-2024-5334 | High | 7.5 | 2024-06-27 | A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the '… |
CVE-2024-27175 | Medium | 4.4 | 2024-06-14 | Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability. An attacker can read any file on the printer. As for the… |
CVE-2024-37295 | High | 7.2 | 2024-06-11 | Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privil… |
CVE-2024-36473 | Medium | 5.3 | 2024-06-10 | Trend Micro VPN Proxy One Pro, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite or create attack but is limited to local Denial of Servi… |
CVE-2024-25975 | Medium | 6.5 | 2024-05-29 | The application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered properly and therefore an… |
CVE-2024-28826 | High | 8.8 | 2024-05-29 | Improper restriction of local upload and download paths in check_sftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 (EOL) allows attacker… |
CVE-2024-20366 | High | 7.8 | 2024-05-15 | A vulnerability in the Tail-f High Availability Cluster Communications (HCC) function pack of Cisco Crosswork Network Services Orchestrator (NSO) could allow a… |
CVE-2024-27945 | High | 7.2 | 2024-05-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The bulk import feature of the affected systems allow a privileged user to upl… |
CVE-2024-27944 | High | 7.2 | 2024-05-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow a privileged user to upload firmware files to the r… |
CVE-2024-27943 | High | 7.2 | 2024-05-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow a privileged user to upload generic files to the ro… |
CVE-2024-25965 | Medium | 6.1 | 2024-05-14 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an external control of file name or path vulnerability. A local high privilege attacker could pot… |
CVE-2024-4818 | Medium | 5.3 | 2024-05-14 | A vulnerability was found in Campcodes Online Laundry Management System 1.0 and classified as problematic. This issue affects some unknown processing of the fi… |
CVE-2024-0100 | Medium | 6.5 | 2024-05-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability in the tracing API, where a user can corrupt system files. A successful exploit of this vulne… |
CVE-2024-0087 | Critical | 9.0 | 2024-05-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability where a user can set the logging location to an arbitrary file. If this file exists, logs are… |
CVE-2024-33860 | Medium | 6.5 | 2024-05-07 | An issue was discovered in Logpoint before 7.4.0. It allows Local File Inclusion (LFI) when an arbitrary File Path is used within the File System Collector. Th… |
CVE-2024-33671 | High | 7.7 | 2024-04-26 | An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. The Backup Exec Deduplication Multi-threaded Streaming Agent can be leveraged to perf… |
CVE-2024-31492 | High | 8.2 | 2024-04-10 | An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a loca… |
CVE-2024-30265 | High | 7.5 | 2024-04-03 | Collabora Online is a collaborative online office suite based on LibreOffice technology. Any deployment of voilà dashboard allow local file inclusion. Any file… |
CVE-2024-22178 | Medium | 4.9 | 2024-04-03 | A file write vulnerability exists in the OAS Engine Save Security Configuration functionality of Open Automation Software OAS Platform V19.00.0057. A specially… |
CVE-2024-21870 | Medium | 4.9 | 2024-04-03 | A file write vulnerability exists in the OAS Engine Tags Configuration functionality of Open Automation Software OAS Platform V19.00.0057. A specially crafted… |
CVE-2024-2917 | Medium | 5.4 | 2024-03-26 | A vulnerability was found in Campcodes House Rental Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown funct… |
CVE-2024-1603 | High | 7.5 | 2024-03-23 | paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file. |
CVE-2024-23634 | Medium | 6.0 | 2024-03-20 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. An arbitrary file renaming vulnerability exist… |
CVE-2023-47147 | Medium | 5.9 | 2024-03-15 | IBM Sterling Secure Proxy 6.0.3 and 6.1.0 could allow an attacker to overwrite a log message under specific conditions. IBM X-Force ID: 270598. |
CVE-2024-26185 | Medium | 6.5 | 2024-03-12 | Windows Compressed Folder Tampering Vulnerability |
CVE-2023-26282 | Medium | 4.2 | 2024-03-05 | IBM Watson CP4D Data Stores 4.6.0 through 4.6.3 could allow a user with physical access and specific knowledge of the system to modify files or data on the sys… |
CVE-2024-2155 | Medium | 4.3 | 2024-03-04 | A vulnerability was found in SourceCodester Best POS Management System 1.0 and classified as problematic. This issue affects some unknown processing of the fil… |
CVE-2024-2150 | Medium | 5.3 | 2024-03-03 | A vulnerability, which was classified as critical, has been found in SourceCodester Insurance Management System 1.0. This issue affects some unknown processing… |
CVE-2024-25117 | Medium | 6.8 | 2024-02-21 | php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't… |
CVE-2020-36772 | Medium | 4.4 | 2024-01-22 | CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitr… |
CVE-2024-0728 | Medium | 4.7 | 2024-01-19 | A vulnerability classified as problematic was found in ForU CMS up to 2020-06-23. Affected by this vulnerability is an unknown functionality of the file channe… |
CVE-2023-49864 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb… |
CVE-2023-49863 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb… |
CVE-2023-49862 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb… |
CVE-2023-49738 | High | 7.5 | 2024-01-10 | An information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP reque… |
CVE-2023-47862 | Critical | 9.8 | 2024-01-10 | A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP r… |
CVE-2023-47171 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb… |
CVE-2024-20652 | High | 8.1 | 2024-01-09 | Windows HTML Platforms Security Feature Bypass Vulnerability |
CVE-2024-0265 | Medium | 6.3 | 2024-01-07 | A vulnerability was found in SourceCodester Clinic Queuing System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /i… |
CVE-2023-6569 | High | 8.2 | 2023-12-14 | External Control of File Name or Path in h2oai/h2o-3 |
CVE-2023-36019 | Critical | 9.6 | 2023-12-12 | Microsoft Power Platform Connector Spoofing Vulnerability |
CVE-2023-6618 | Medium | 5.5 | 2023-12-08 | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as problematic. Affected by this vulnerability is an unk… |
CVE-2023-5247 | High | 7.8 | 2023-11-30 | Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA Engineering Software Products allows a m… |
CVE-2023-40194 | High | 8.8 | 2023-11-27 | An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to mistreatment of whitespace character… |