deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-20331
Published: 2025-08-06
Description: A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a stored XSS attack against a user of the interface.

This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have at least a low-privileged account on the affected device.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-80
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise_xss_acc_cont-YsR4uT4U
CVE: CVE-2025-20332
Published: 2025-08-06
Description: A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device.

This vulnerability is due to the lack of server-side validation of Administrator permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected system. A successful exploit could allow the attacker to modify descriptions of files on a specific page. To exploit this vulnerability, an attacker would need valid read-only Administrator&nbsp;credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise_xss_acc_cont-YsR4uT4U
CVE: CVE-2025-30127
Published: 2025-08-06
Description: An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. Once access is gained either by default, common, or cracked passwords, the video recordings (containing sensitive routes, conversations, and footage) are open for downloading by creating a socket to command port 7777, and then downloading video via port 7778 and audio via port 7779.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200, CWE-284, CWE-521
References: https://geochen.medium.com/marbella-dashcam-ab40ca41adec; https://github.com/geo-chen/Marbella/; https://github.com/geo-chen/Marbella/blob/main/README.md#finding-2---cve-2025-30127-video-recordings-open-to-being-downloaded-via-ports-7777-7778-7779
CVE: CVE-2025-8419
Published: 2025-08-06
Description: A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-93
References: https://access.redhat.com/errata/RHSA-2025:15336; https://access.redhat.com/errata/RHSA-2025:15337; https://access.redhat.com/errata/RHSA-2025:15338
CVE: CVE-2025-8665
Published: 2025-08-06
Description: A vulnerability, which was classified as critical, has been found in agno-agi agno up to 1.7.5. This issue affects the function MCPTools/MultiMCPTools in the library libs/agno/agno/tools/mcp.py of the component Model Context Protocol Handler. The manipulation of the argument command leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/bayuncao-bit/vul-30; https://github.com/bayuncao-bit/vul-30#proof-of-concept; https://vuldb.com/?ctiid.319025
CVE: CVE-2025-8667
Published: 2025-08-06
Description: A vulnerability, which was classified as critical, was found in SkyworkAI DeepResearchAgent up to 08eb7f8eb9505d0094d75bb97ff7dacc3fa3bbf2. Affected is the function from_code/from_dict/from_mcp of the file src/tools/tools.py. The manipulation leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/bayuncao-bit/vul-36; https://github.com/bayuncao-bit/vul-36#proof-of-concept; https://vuldb.com/?ctiid.319026
CVE: CVE-2025-8130
Published: 2025-08-06
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-38746
Published: 2025-08-06
Description: Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://www.dell.com/support/kbdoc/en-us/000353093/dsa-2025-315
CVE: CVE-2025-38747
Published: 2025-08-06
Description: Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contain a Creation of Temporary File With Insecure Permissions vulnerability. A local authenticated attacker could potentially exploit this vulnerability, leading to Elevation of Privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-378
References: https://www.dell.com/support/kbdoc/en-us/000353093/dsa-2025-315
CVE: CVE-2025-45764
Published: 2025-08-06
Description: jsrsasign v11.1.0 was discovered to contain weak encryption. NOTE: this issue has been disputed by a third party who believes that CVE IDs can be assigned for key lengths in specific applications that use a library, and should not be assigned to the default key lengths in a library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record.
CVSS Score: 3.2 (LOW)
CWE: CWE-326
References: https://gist.github.com/ZupeiNie/2250cf1758771d56272dc326ce066202; https://github.com/kjur/jsrsasign/issues/634
CVE: CVE-2025-45766
Published: 2025-08-06
Description: poco v1.14.1-release was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record.
CVSS Score: 7.0 (HIGH)
CWE: CWE-327
References: https://gist.github.com/ZupeiNie/9de26f17a5e135b50fa388999e912c42; https://github.com/pocoproject; https://github.com/pocoproject/poco
CVE: CVE-2025-46659
Published: 2025-08-06
Description: An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. Information disclosure can occur via an external HTTPS request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://gist.github.com/Jowu73/a393a8de99f2dbefcca7d9727c412dff; https://www.4cstrategies.com/solutions/exonaut/
CVE: CVE-2025-51624
Published: 2025-08-06
Description: Cross-site scripting (XSS) vulnerability in Zone Bitaqati thru 3.4.0.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: http://bitaqati.com; http://zone.com; https://medium.com/@a77777mad/cross-site-scripting-xss-vulnerability-in-zone-bitaqati-v3-4-0-a05b980b4df4
CVE: CVE-2024-55398
Published: 2025-08-06
Description: 4C Strategies Exonaut before v22.4 was discovered to contain insecure permissions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: http://exonaut.com; https://gist.github.com/Jowu73/27fc259bf1355e1c557f0f54d630f9ca
CVE: CVE-2024-55399
Published: 2025-08-06
Description: 4C Strategies Exonaut before v21.6.2.1-1 was discovered to contain a Server-Side Request Forgery (SSRF).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: http://exonaut.com; https://gist.github.com/Jowu73/1e8cb2a5c73a79eb36f2c6b3d9eb1b83
CVE: CVE-2024-55402
Published: 2025-08-06
Description: 4C Strategies Exonaut before v22.4 was discovered to contain an access control issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: http://exonaut.com; https://gist.github.com/Jowu73/762f2240dcc56352c1e95da78ffff094
CVE: CVE-2025-46660
Published: 2025-08-06
Description: An issue was discovered in 4C Strategies Exonaut 21.6. Passwords, stored in the database, are hashed without a salt.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-922
References: https://gist.github.com/Jowu73/b8a2a267804dbfb17876dbedbbbfb28f; https://www.4cstrategies.com/solutions/exonaut/
CVE: CVE-2025-47908
Published: 2025-08-06
Description: Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.
CVSS Score: 7.5 (HIGH)
References: https://github.com/rs/cors/issues/170; https://github.com/rs/cors/pull/171; https://pkg.go.dev/vuln/GO-2024-2883
CVE: CVE-2025-50740
Published: 2025-08-06
Description: AutoConnect 1.4.2, an Arduino library, is vulnerable to a cross site scripting (xss) vulnerability. The AutoConnect web interface /_ac/config allows HTML/JS code to be executed via a crafted network SSID.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/AbhijithAJ/AutoConnect_IoT_Lib_vulnerability/blob/main/Report.pdf; https://github.com/Hieromon/AutoConnect/issues/632; https://github.com/AbhijithAJ/AutoConnect_IoT_Lib_vulnerability/blob/main/Report.pdf
CVE: CVE-2025-51052
Published: 2025-08-06
Description: A path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'file_get_contents()' function call in '/api_vedo/template'.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-23
References: http://vedo.com; https://github.com/jacopoaugelli/vedo-suite-exploits
CVE: CVE-2025-51053
Published: 2025-08-06
Description: A Cross-site scripting (XSS) vulnerability in /api_vedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary Javascript or HTML code and potentially trigger code execution in victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://bottinelli.com; https://github.com/jacopoaugelli/vedo-suite-exploits
CVE: CVE-2025-51054
Published: 2025-08-06
Description: Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privilege JWT token without prior authentication via sending an empty HTTP POST request to the /autologin/ API endpoint.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://bottinelli.com; https://github.com/jacopoaugelli/vedo-suite-exploits
CVE: CVE-2025-51055
Published: 2025-08-06
Description: Insecure Data Storage of credentials has been found in /api_vedo/configuration/config.yml file in Vedo Suite version 2024.17. This file contains clear-text credentials, secret keys, and database information.
CVSS Score: 8.6 (HIGH)
CWE: CWE-312
References: http://bottinelli.com; https://github.com/jacopoaugelli/vedo-suite-exploits
CVE: CVE-2025-51056
Published: 2025-08-06
Description: An unrestricted file upload vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to write to arbitrary filesystem paths by exploiting the insecure 'uploadPreviews()' custom function in '/api_vedo/colorways_preview', ultimately resulting in remote code execution (RCE).
CVSS Score: 8.2 (HIGH)
CWE: CWE-434
References: http://bottinelli.com; https://github.com/jacopoaugelli/vedo-suite-exploits; https://github.com/jacopoaugelli/vedo-suite-exploits
CVE: CVE-2025-51057
Published: 2025-08-06
Description: A local file inclusion (LFI) vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'readfile()' function call in '/api_vedo/video/preview'.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-98
References: http://bottinelli.com; https://github.com/jacopoaugelli/vedo-suite-exploits; https://github.com/jacopoaugelli/vedo-suite-exploits
CVE: CVE-2025-51058
Published: 2025-08-06
Description: Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery (SSRF) in the /api_vedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the "file" URL parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: http://bottinelli.com; https://github.com/jacopoaugelli/vedo-suite-exploits; https://github.com/jacopoaugelli/vedo-suite-exploits
CVE: CVE-2025-6632
Published: 2025-08-06
Description: A maliciously crafted PSD file, when linked or imported into Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0016
CVE: CVE-2025-6633
Published: 2025-08-06
Description: A maliciously crafted RBG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0016
CVE: CVE-2025-6634
Published: 2025-08-06
Description: A maliciously crafted TGA file, when linked or imported into Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0016
CVE: CVE-2025-7768
Published: 2025-08-06
Description: Tigo Energy's Cloud Connect Advanced (CCA) device contains hard-coded credentials that allow unauthorized users to gain administrative access. This vulnerability enables attackers to escalate privileges and take full control of the device, potentially modifying system settings, disrupting solar energy production, and interfering with safety mechanisms.
CWE: CWE-798
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-02
CVE: CVE-2025-7769
Published: 2025-08-06
Description: Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is called, allowing remote code execution due to improper handling of user input. When used with default credentials, this enables attackers to execute arbitrary commands on the device that could cause potential unauthorized access, service disruption, and data exposure.
CWE: CWE-77
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-02
CVE: CVE-2025-7770
Published: 2025-08-06
Description: Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are generated using a predictable method based on the current timestamp, allowing attackers to recreate valid session IDs. When combined with the ability to circumvent session ID requirements for certain commands, this enables unauthorized access to sensitive device functions on connected solar optimization systems.
CWE: CWE-337
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-02
CVE: CVE-2023-3194
Published: 2025-08-06
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-8086
Published: 2025-08-06
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-54785
Published: 2025-08-07
Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6  and 8.8.0, user-supplied input is not validated/sanitized before it is passed to the unserialize function, which could lead to penetration, privilege escalation, sensitive data exposure, Denial of Service, cryptomining and ransomware. This issue is fixed in version 7.14.7 and 8.8.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7; https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-53cp-mpfw-qj67
CVE: CVE-2025-54786
Published: 2025-08-07
Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated actor can view any user's meeting (calendar event) data given their username, related functionality allows user enumeration. This is fixed in versions 7.14.7 and 8.8.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-284, CWE-287
References: https://docs.suitecrm.com/8.x/admin/releases/8.8; https://github.com/SuiteCRM/SuiteCRM-Core/security/advisories/GHSA-rf2v-4mv3-qcgm
CVE: CVE-2025-54788
Published: 2025-08-07
Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions and below, the InboundEmail module allows the arbitrary execution of queries in the backend database, leading to SQL injection. This can have wide-reaching implications on confidentiality, integrity, and availability, as database data can be retrieved, modified, or removed entirely. This issue is fixed in version 7.14.7.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7; https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-v3m9-8wg7-c72x
CVE: CVE-2025-3770
Published: 2025-08-07
Description: EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.
CVSS Score: 7.0 (HIGH)
CWE: CWE-693
References: https://github.com/tianocore/edk2/security/advisories/GHSA-vx5v-4gg6-6qxr
CVE: CVE-2025-54783
Published: 2025-08-07
Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include some arbitrary domain with malicious JavaScript code at the end. The server will attempt to block the arbitrary domain but allow the JavaScript code to execute. This is fixed in version 7.14.7.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7; https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-vqrj-gp9m-8c6r
CVE: CVE-2025-54784
Published: 2025-08-07
Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a Cross Site Scripting (XSS) vulnerability in the email viewer in versions 7.14.0 through 7.14.6. An external attacker could send a prepared message to the inbox of the SuiteCRM-instance. By simply viewing emails as the logged-in user, the payload can be triggered. With that, an attacker is able to run arbitrary actions as the logged-in user - like extracting data, or if it is an admin executing the payload, takeover the instance. This is fixed in versions 7.14.7.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7; https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-vg8q-xcq5-mh3p
CVE: CVE-2025-54798
Published: 2025-08-07
Description: tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4.
CVSS Score: 2.5 (LOW)
CWE: CWE-59
References: https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b; https://github.com/raszi/node-tmp/issues/207; https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6
CVE: CVE-2025-54799
Published: 2025-08-07
Description: Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package (thus the lego library and the lego cli as well) don't enforce HTTPS when talking to CAs as an ACME client. Unlike the http-01 challenge which solves an ACME challenge over unencrypted HTTP, the ACME protocol requires HTTPS when a client communicates with the CA to performs ACME functions. However, the library fails to enforce HTTPS both in the original discover URL (configured by the library user) and in the subsequent addresses returned by the CAs in the directory and order objects. If users input HTTP URLs or CAs misconfigure endpoints, protocol operations occur over HTTP instead of HTTPS. This compromises privacy by exposing request/response details like account and request identifiers to network attackers. This was fixed in version 4.25.2.
CWE: CWE-319
References: https://github.com/go-acme/lego/commit/238454b5f74f3cfcbb244ff0d0dc914a4ad44b96; https://github.com/go-acme/lego/security/advisories/GHSA-q82r-2j7m-9rv4
CVE: CVE-2025-54882
Published: 2025-08-07
Description: Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stores the cloud TGT received during logon in the Kerberos credential cache. The created credential cache collection and received credentials are stored as world readable. This is fixed in versions 0.9.22 and 1.2.0. To work around this issue, remove all read access to Himmelblau caches for all users except for owners.
CVSS Score: 7.1 (HIGH)
CWE: CWE-522
References: https://github.com/himmelblau-idm/himmelblau/commit/b562053df3dffb1dd9ab3d09af986886773be2ad; https://github.com/himmelblau-idm/himmelblau/commit/faae58b0384aca8b21b4be5f1c507412eec3778a; https://github.com/himmelblau-idm/himmelblau/releases/tag/0.9.22
CVE: CVE-2025-54885
Published: 2025-08-07
Description: Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication. In versions 2.0.0 and below, a protocol compliance bug causes the client to generate a fixed 252 bits of entropy instead of the intended bit length of the safe prime (defaulted to 2048 bits). The client public value is being generated from a private value that is 4 bits below the specification. This reduces the protocol's designed security margin it is now practically exploitable. The servers full sized 2048 bit random number is used to create the shared session key and password proof. This is fixed in version 2.0.1.
CWE: CWE-331
References: https://github.com/simbo1905/thinbus-srp-npm/issues/28; https://github.com/simbo1905/thinbus-srp-npm/pull/30/commits/4aeaea2366e090765a8204059c7bcf3616438d31; https://github.com/simbo1905/thinbus-srp-npm/security/advisories/GHSA-8q6v-474h-whgg
CVE: CVE-2025-29865
Published: 2025-08-07
Description: : Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TAGFREE X-Free Uploader XFU allows Path Traversal.This issue affects X-Free Uploader: from 1.0.1.0084 before 1.0.1.0085, from 2.0.1.0034 before 2.0.1.0035.
CWE: CWE-22
References: https://www.boho.or.kr/kr/bbs/view.do?searchCnd=&bbsId=B0000302&searchWrd=&menuNo=205023&pageIndex=1&categoryCode=&nttId=71825