The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.
172 vulnerabilities with CWE-35
CVE-2025-39491
HIGH
WHMpress 6.2-revision-9 - Path Traversal via '.../...//'
CVSS 8.1
CVE-2025-40573
MEDIUM
SCALANCE LPE9403 < V4.0 HF0 - Path Traversal via Backup Restore
CVSS 4.4
CVE-2025-47649
HIGH
ilmosys Open Close WooCommerce Store <4.9.5 - Path Traversal
CVSS 8.8
CVE-2025-47636
HIGH
Fernando Briano <0.91.0 - Path Traversal
CVSS 7.5
CVE-2025-32950
MEDIUM
Jmix Framework 1.0.0-1.6.1 and 2.0.0-2.3.4 - Path Traversal via FileRef Parameter
CVSS 6.5
CVE-2025-39470
HIGH
ThimPress Ivy School <1.6.0 - Path Traversal
CVSS 8.1
CVE-2025-24908
MEDIUM
Hitachi Vantara Pentaho <10.2.0.2 - Path Traversal
CVSS 6.8
CVE-2025-24907
MEDIUM
Hitachi Vantara Pentaho <10.2.0.2 - Path Traversal
CVSS 6.8
CVE-2025-39598
MEDIUM
Quý Lê 91 Administrator Z <2025.03.28 - Path Traversal
CVSS 4.9
CVE-2025-30966
MEDIUM
NotFound WPJobBoard - Path Traversal
CVSS 5.4
CVE-2025-32585
HIGH
Trusty Plugins Shop Products Filter <1.2 - Path Traversal
CVSS 7.5
CVE-2025-30014
HIGH
SAP Capital Yield Tax Management - Path Traversal
CVSS 7.7
CVE-2025-30834
HIGH
Bit Apps Bit Assist <1.5.4 - Path Traversal
CVSS 7.5
CVE-2025-26940
MEDIUM
NotFound Pie Register Premium <3.8.3.2 - Path Traversal
CVSS 6.3
CVE-2025-27274
MEDIUM
NotFound GPX Viewer <2.2.11 - Path Traversal
CVSS 4.9
CVE-2025-25122
HIGH
WizShop <= 3.0.2 - Path Traversal via '.../...//'
CVSS 8.1
CVE-2025-26935
HIGH
WP Job Portal <= 2.2.8 - Path Traversal and Local File Inclusion via Dot-Slash Sequence
CVSS 7.5
CVE-2025-26876
MEDIUM
CodeManas Search with Typesense <= 2.0.8 - Path Traversal via '.../...//'
CVSS 6.8
CVE-2025-26357
MEDIUM
Q-Free MaxTime <= 2.11.0 - Authenticated Path Traversal via Crafted HTTP Requests
CVSS 4.9
CVE-2025-26356
HIGH
Q-Free MaxTime <= 2.11.0 - Authenticated Path Traversal via setActive Endpoint
CVSS 7.2
CVE-2025-26355
MEDIUM
Q-Free MaxTime <= 2.11.0 - Authenticated Path Traversal via Crafted HTTP Requests
CVSS 6.5
CVE-2025-26354
HIGH
Q-Free MaxTime <= 2.11.0 - Authenticated Path Traversal via Database Copy Endpoint
CVSS 7.2
CVE-2025-26353
MEDIUM
Q-Free MaxTime <= 2.11.0 - Authenticated Path Traversal via Crafted HTTP Requests
CVSS 4.9
CVE-2025-26352
MEDIUM
Q-Free MaxTime <= 2.11.0 - Authenticated Path Traversal via Template Deletion Mechanism
CVSS 6.5
CVE-2025-26351
MEDIUM
Q-Free MaxTime <= 2.11.0 - Authenticated Path Traversal via Template Download Mechanism
CVSS 4.9
Details
Vulnerabilities
172