CWE-706: CWE-706

This CVE describes an Insecure Direct Object Reference (IDOR) vulnerability in Flygo's employee management page. Authenticated general users can manip...

This vulnerability in Directus allows attackers to hijack password reset emails by using email addresses with accented characters that MySQL/MariaDB t...

In File Browser versions before 2.57.1, authenticated users can bypass file access restrictions by adding extra slashes to file paths in requests. Thi...

This vulnerability in curl versions before 7.83.1 could cause the wrong file to be deleted when using the --no-clobber option with --remove-on-error. ...

This vulnerability in Avast Premium Security allows local attackers to escalate privileges from low-privileged user accounts to SYSTEM-level access by...

This vulnerability in Hono web framework versions 4.8.0 through 4.9.5 allows path confusion attacks that could bypass proxy-level access controls like...

The Qi Addons For Elementor WordPress plugin has a Remote File Inclusion vulnerability that allows authenticated attackers with Contributor-level acce...

This vulnerability in Docassemble allows attackers to access sensitive information through URL manipulation. It affects versions 1.4.53 to 1.4.96 of t...

This vulnerability in Mastodon allows attackers to spoof domains they don't own by exploiting flaws in domain name normalization. This could enable im...

In NamelessMC versions 2.1.4 and earlier, when an administrator deletes a spammer's account, all posts by that user are deleted along with entire disc...

This vulnerability allows remote authenticated administrators in Chamilo LMS to upload malicious PHP files through directory traversal, leading to rem...

A logic flaw in CommandKit's message command handler exposes the alias name instead of the canonical command name in middleware and execution contexts...

This vulnerability in Nextcloud Server allows a malicious user to upload a manipulated SVG file that references other file paths. If the referenced fi...

A memory access vulnerability in the Linux kernel's ftrace subsystem could cause kernel panics when handling invalid instruction pointer addresses. Th...

CVE-2025-29914 is a path normalization vulnerability in OWASP Coraza WAF where requests starting with double slashes (//) cause incorrect REQUEST_FILE...

This vulnerability in the lambdaisland/uri library allows attackers to craft malicious URLs that cause incorrect authority parsing, potentially bypass...

This vulnerability in Logpoint SAML Authentication allows attackers to delete arbitrary files by injecting crafted filenames into SAML SSO-URL respons...

An insecure direct object reference (IDOR) vulnerability in PHPGurukul Online Birth Certificate System v1.0 allows authenticated users to access other...

SmarterMail versions before build 9518 have an unauthenticated path coercion vulnerability that allows attackers to force the service to authenticate ...

This vulnerability in the zx CLI tool allows arbitrary directory deletion when using the --prefer-local flag. Attackers can delete external node_modul...