CVE-2026-49779
Customer Path Traversal in Tax Exempt for WooCommerce <= 1.9.3 versions.
CVSS
6.5
Medio
EPSS
0.3%
p27
KEV
—
Exploit Today
8
0-100
Publicado: 2 jul 2026 · Última mod.: 2 jul 2026 · CWE-35
0.3%EPSS · 30 días0.3%
2026-07-032026-07-17
Customer Path Traversal in Tax Exempt for WooCommerce <= 1.9.3 versions.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2025-684287.5 ALT79.2%
——24jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs. Other affected methods are `addImage`, `html`, and `addFont`. Only the node.js builds of the library are affected, namely the `dist/jspdf.node.js` and `dist/jspdf.node.min.js` files. The vulnerability has been fixed in jsPDF@4.0.0. This version restricts file system access per default. This semver-major update does not introduce other breaking changes. Some workarounds areavailable. With recent node versions, jsPDF recommends using the `--permission` flag in production. The feature was introduced experimentally in v20.0.0 and is stable since v22.13.0/v23.5.0/v24.0.0. For older node versions, sanitize user-provided paths before passing them to jsPDF.3dCVE-2024-391719.8 CRÍ65.0%
——19Directory Travel in PHPVibe v11.0.46 due to incomplete blacklist checksums and directory checks, which can lead to code execution via writing specific statements to .htaccess and code to a file with a .png suffix.9dCVE-2026-200348.8 ALT49.5%
——15A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of a targeted device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.16dCVE-2024-542167.7 ALT41.7%
——13Path Traversal: '.../...//' vulnerability in reputeinfosystems ARForms allows Path Traversal.
This issue affects ARForms: from n/a before 7.0.2.10d