Threats Tagged 'cwe-35'

CVE-2026-52707 is a high-severity vulnerability in Mikado-Themes Kastell versions up to and including 2.0. It allows unauthenticated attackers to perform local file inclusion via a path traversal flaw. This can lead to full confidentiality, integrity, and availability compromise of the affected system. No official patch or remediation guidance is currently available from the vendor.

Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.

CVE-2026-49112 is a high-severity unauthenticated path traversal vulnerability affecting Tammersoft Shared Files versions up to and including 1.7.64. This vulnerability allows an attacker to access files outside the intended directory by exploiting path traversal sequences such as '.../...//'. The vulnerability does not require authentication and impacts confidentiality without affecting integrity or availability.

A path traversal vulnerability (CWE-35) exists in WP Customer Area versions up to and including 8.3.4. This vulnerability allows a user with limited privileges to exploit custom role functionality to perform path traversal attacks. The vulnerability has a high severity with a CVSS score of 8.8, indicating it can lead to high impact on confidentiality, integrity, and availability.

CVE-2026-40128 is a critical path traversal vulnerability in SAP NetWeaver Application Server Java (Web Container). It allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters. This manipulation enables the attacker to traverse directories and process arbitrary files on the local system. Successful exploitation could lead to viewing or modifying sensitive information or causing denial of service by making parts of the system unavailable.

CVE-2026-24315 is a path traversal vulnerability in SAP Fiori Launchpad that allows attackers to craft malicious URLs triggering arbitrary service calls. Exploitation requires advanced system knowledge and user interaction. The vulnerability impacts confidentiality and integrity at a low level, with no effect on availability. The CVSS score is 4.2, indicating medium severity. No official patch or remediation guidance is currently available from the vendor.