CWE-552: Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- codefuture image hosting script, davidtavarez cf image hosting script +1 moreCF Image Hosting Script 1.6.5 Unauthorized Database Access9.3 Critical
- chamilo lms, chamilo-lms +1 moreChamilo LMS affected by unauthenticated RCE in main/install folder9.3 Critical
- synology ssl vpn clientA files or directories accessible to external parties vulnerability in Synology SSL VPN Client...6.5 Medium
- aces lorisLORIS has a path traversal in FilesDownloadHandler7.7 High
- aces lorisLORIS has potential cross-site scripting in help_editor module8.7 High
- aces lorisLORIS has a path traversal in static router7.5 High
- openclawOpenClaw < 2026.3.31 - Arbitrary Host File Read via appendLocalMediaParentRoots Self-Whitelisting6.0 Medium
- rack, red hat satellite 6 +1 moreRack: Local file inclusion in `Rack::Static` via URL Prefix Matching7.5 High
- hapifhir hl7 fhir core, org.hl7.fhir.core +1 moreHAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft9.3 Critical
- code-projects online food ordering systemcode-projects Online Food Ordering System localhost.sql privilege escalation6.9 Medium
- ruckus wireless access point, ruckus unleashed, smartzone 100 (sz-100) (eol) +5 more +7 moreRuckus AP CLI Arbitrary File Read Allows Authenticated Remote File Access6.9 Medium
- codra panorama suitePotential unauthorized access to files on the Web HMI server host7.7 High
- code-projects simple food ordering system, carmelo simple food order system +1 morecode-projects Simple Food Ordering System Database Backup food.sql file access6.9 Medium
- error311 fileriseFileRise: WebDAV upload path bypasses filename validation enforced by regular uploads4.3 Medium
- b3log siyuanSiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes6.8 Medium
- zkteco inc. zkaccess professionalZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions8.7 High
- @tinacms cli, ssw tinacms\/cli +1 moreArbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI6.2 Medium
- asseco liveLocal File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0...6.5 Medium
- phpmassmail eversyncEverSync 0.5 Arbitrary File Download via files Directory8.7 High
- sick ag lector83x, lector85x +1 moreCVE-2026-23319.8 Critical
- sick ag lector83x, lector85x +1 moreCVE-2026-23309.4 Critical
- hallo welt! gmbh bluespiceImproper permission checks in Extension:NSFileRepo6.6 Medium
- error311 fileriseFileRise affected by an Unauthenticated File Read Due to Insufficient Access Control7.5 High
- weberpwebERP 4.15.1 - Unauthenticated Backup File Access8.6 High
- quickheal total securityA vulnerability exists in Quick Heal Total Security 23.0.0 in the quarantine management component...7.8 High
- nixos nixpkgsNixOs Odoo database and filestore publicly accessible with default odoo configuration9.1 Critical
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 moreAuthenticated Arbitrary File Deletion Vulnerability in AOS-10 or AOS-8 Command Line Interface (CLI)6.5 Medium
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 moreUnauthenticated Arbitrary File Deletion Vulnerability in AOS-8 Operating System8.2 High
- phpgurukul news portalphpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in remove_file...9.1 Critical
- busymac pal mcp serverA path traversal vulnerability exists in Zen MCP Server before 9.8.2 that allows authenticated...6.5 Medium
- kaysus ks-wr3600 firmwareKAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 mishandle configuration management. Once any...8.8 High
- cbutlerjr wp-members membership pluginWP-Members Membership Plugin <= 3.5.4.4 - Unauthenticated Information Exposure via Unprotected Files5.3 Medium
- mmaitre314 picklescanpicklescan - Arbitrary File Writing via distutils Module Bypass9.3 Critical
- kings information & network co. kess enterpriseData Exposure in Kings Information & Network KESS Enterprise8.6 High
- pbootcmsPbootCMS SQLite Database pbootcms.db file access6.3 Medium
- guangzhou v-solution electronic technology gpon/epon olt platformV-SOL GPON/EPON OLT Platform 2.03 Unauthenticated Configuration Download8.7 High
- microhard systems 3g/4g cellular ethernet and serial gateway configuration download, microhardcorp bullet-3g firmware, bullet-lte firmware +9 more +11 moreMicrohard Systems IPn4G 1.1.0 Configuration Disclosure via Authenticated Download7.1 High
- yuzutech krokidue to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and...8.7 High
- churchcrm, churchcrm crm +1 moreChurchCRM vulnerable to RCE with database restore functionality9.1 Critical
- shenzhen sixun software sixun shanghui group business management systemShenzhen Sixun Software Sixun Shanghui Group Business Management System ExportFiles file access6.3 Medium
- ays-pro secure copy content protection and content lockingSecure Copy Content Protection and Content Locking <= 4.9.2 - Unauthenticated Sensitive Information Exposure via Exposed CSV Export File5.3 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality4.9 Medium
- tainacanTainacan <= 1.0.0 - Unauthenticated Information Exposure5.3 Medium
- jcollings import wp – export and import csv and xml files to wordpressImport WP – Export and Import CSV and XML files to WordPress <= 2.14.17 - Unauthenticated Information Exposure5.3 Medium
- osc ondemandOpen OnDemand RPM packages create world writable locations6.9 Medium
- tanium tanosTanium addressed an arbitrary file deletion vulnerability in TanOS.5.6 Medium
- janobe farm management systemSourceCodester Farm Management System exposure of information through directory listing6.9 Medium
- shenzhen longjing technology co. ltd. bems apiLongjing Technology BEMS API <= 1.21 Remote Arbitrary File Download8.7 High
- premierturk information technologies inc. excavation management information systemImproper Access Control in Premierturk's Excavation Management Information System8.1 High
- ibm cognos analytics certified containersIBM Cognos Analytics Certified Containers information disclosure5.3 Medium
- Show moreLoading…