CWE-35 — known CVE vulnerabilities

CVEs classified under CWE-35, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (50)

• CVE-2025-59793 — CVSS 9.9 (critical): Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be…
• CVE-2026-6074 — CVSS 9.8 (critical): Intrado 911 Emergency Gateway (EGW) 5.x, 6.x, and 7.x contain a path traversal vulnerability in the download_debuglog_file.php endpoint…
• CVE-2025-41723 — CVSS 9.8 (critical): The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the path restriction…
• CVE-2025-42937 — CVSS 9.8 (critical): SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An unauthenticated attacker could…
• CVE-2025-30515 — CVSS 9.8 (critical): CyberData 011209 Intercom could allow an authenticated attacker to upload arbitrary files to multiple locations within the system.
• CVE-2026-52703 — CVSS 9.6 (critical): Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.
• CVE-2025-53417: DIAView (v4.2.0 and prior) - Directory Traversal Information Disclosure Vulnerability
• CVE-2024-56045 — CVSS 9.3 (critical): Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through…
• CVE-2024-40505 — CVSS 9.3 (critical): Directory Traversal vulnerability in D-Link DAP-1650 Firmware v.1.03 allows a local attacker to escalate privileges via the hedwig.cgi…
• CVE-2025-5598: Path Traversal vulnerability in WF Steuerungstechnik GmbH airleader MASTER allows Retrieve Embedded Sensitive Data.This issue affects…
• CVE-2026-7302 — CVSS 9.1 (critical): SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write…
• CVE-2020-27130 — CVSS 9.1 (critical): A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to gain access to sensitive information. The…
• CVE-2026-40128 — CVSS 9.0 (critical): SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that…
• CVE-2026-42661 — CVSS 8.8 (high): Custom role Path Traversal in WP Customer Area <= 8.3.4 versions.
• CVE-2026-45495 — CVSS 8.8 (high): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
• CVE-2026-20034 — CVSS 8.8 (high): A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute…
• CVE-2025-59099: The Access Manager is using the open source web server CompactWebServer written in C#. This web server is affected by a path traversal…
• CVE-2025-8088 — CVSS 8.8 (high) — actively exploited: A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious…
• CVE-2025-47649 — CVSS 8.8 (high): Path Traversal: '.../...//' vulnerability in StackWC Open Close WooCommerce Store woc-open-close allows PHP Local File Inclusion.This issue…
• CVE-2024-47169 — CVSS 8.8 (high): Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330…
• CVE-2026-42930 — CVSS 8.7 (high): When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode…
• CVE-2025-53880: A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or…
• CVE-2024-49249 — CVSS 8.6 (high): Path Traversal: '.../...//' vulnerability in SMSA Express SMSA Shipping smsa-shipping-official allows Path Traversal.This issue affects…
• CVE-2024-21575 — CVSS 8.6 (high): ComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the `image.filename` field in a POST…
• CVE-2024-52447 — CVSS 8.6 (high): Path Traversal: '.../...//' vulnerability in corporatezen222 Contact Page With Google Map contact-page-with-google-map allows Path…
• CVE-2024-56055 — CVSS 8.5 (high): Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through…
• CVE-2024-56049 — CVSS 8.5 (high): Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through…
• CVE-2026-25705 — CVSS 8.4 (high): A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extens…
• CVE-2024-56214 — CVSS 8.3 (high): Path Traversal: '.../...//' vulnerability in DeluxeThemes Userpro userpro allows Path Traversal.This issue affects Userpro: from n/a…
• CVE-2024-11136: The default TCL Camera application exposes a provider vulnerable to path traversal vulnerability. Malicious application can supply…
• CVE-2026-52707 — CVSS 8.1 (high): Unauthenticated Local File Inclusion in Kastell <= 2.0 versions.
• CVE-2025-48090 — CVSS 8.1 (high): Path Traversal: '.../...//' vulnerability in CocoBasic Blanka - One Page WordPress Theme blanka-wp allows PHP Local File Inclusion.This…
• CVE-2025-39467 — CVSS 8.1 (high): Path Traversal: '.../...//' vulnerability in Mikado-Themes Wanderland wanderland allows PHP Local File Inclusion.This issue affects…
• CVE-2025-52811 — CVSS 8.1 (high): Path Traversal: '.../...//' vulnerability in Creanncy Davenport - Versatile Blog and Magazine WordPress Theme davenport allows PHP Local…
• CVE-2025-52810 — CVSS 8.1 (high): Path Traversal vulnerability in TMRW-studio Katerio - Magazine allows PHP Local File Inclusion. This issue affects Katerio - Magazine: from…
• CVE-2025-49297 — CVSS 8.1 (high): Path Traversal: '.../...//' vulnerability in Mikado-Themes Grill and Chow grillandchow allows PHP Local File Inclusion.This issue affects…
• CVE-2025-49296 — CVSS 8.1 (high): Path Traversal: '.../...//' vulnerability in Mikado-Themes GrandPrix grandprix allows PHP Local File Inclusion.This issue affects…
• CVE-2025-49295 — CVSS 8.1 (high): Path Traversal: '.../...//' vulnerability in Mikado-Themes MediClinic mediclinic allows PHP Local File Inclusion.This issue affects…
• CVE-2025-39475 — CVSS 8.1 (high): Path Traversal: '.../...//' vulnerability in Frenify Arlo arlo allows PHP Local File Inclusion.This issue affects Arlo: from n/a through <=…
• CVE-2025-27010 — CVSS 8.1 (high): Path Traversal: '.../...//' vulnerability in bslthemes Tastyc tastyc allows PHP Local File Inclusion.This issue affects Tastyc: from n/a…
• CVE-2025-39491 — CVSS 8.1 (high): Path Traversal vulnerability in WHMPress WHMpress allows Path Traversal. This issue affects WHMpress: from 6.2 through revision.
• CVE-2025-39470 — CVSS 8.1 (high): Path Traversal: '.../...//' vulnerability in ThimPress Ivy School ivy-school allows PHP Local File Inclusion.This issue affects Ivy School…
• CVE-2024-54362 — CVSS 8.1 (high): Path Traversal: '.../...//' vulnerability in boggibill GetShop ecommerce getshop-ecommerce allows Path Traversal.This issue affects GetShop…
• CVE-2025-25122 — CVSS 8.1 (high): Path Traversal: '.../...//' vulnerability in hashshop WizShop wizshop allows Path Traversal.This issue affects WizShop: from n/a through <=…
• CVE-2025-24685 — CVSS 8.1 (high): Path Traversal: '.../...//' vulnerability in Ihor Kit Morkva UA Shipping morkva-ua-shipping allows PHP Local File Inclusion.This issue…
• CVE-2024-41973 — CVSS 8.1 (high): A low privileged remote attacker can specify an arbitrary file on the filesystem which may lead to an arbitrary file writes with root…
• CVE-2023-7300 — CVSS 8.0 (high): Huawei Home Music System has a path traversal vulnerability. Successful exploitation of this vulnerability may cause the music host file to…
• CVE-2026-44933 — CVSS 7.8 (high): `PluginScript` attempts to `chroot` the plugin to the `repoManagerRoot`, this root is frequently `/` (the system root) in standard…
• CVE-2026-42274: Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule…
• CVE-2025-47176 — CVSS 7.8 (high): '.../...//' in Microsoft Office Outlook allows an authorized attacker to execute code locally.