Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:52:56 +0000 certa-2006-avi-337 — Une vulnérabilité découverte dans les applications Webmin et Usermin permet à un utilisateur mal intentionné de porter… https://cve.radiocsirt.org/vuln/certa-2006-avi-337 certa-2006-avi-337 https://cve.radiocsirt.org/vuln/certa-2006-avi-337 EUVD-2026-141690 https://cve.radiocsirt.org/vuln/euvd-2026-141690 EUVD-2026-141690 https://cve.radiocsirt.org/vuln/euvd-2026-141690 fkie_cve-2006-3392 https://cve.radiocsirt.org/vuln/fkie_cve-2006-3392 <p>Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using &#34;..%01&#34; sequences, which bypass the removal of &#34;../&#34; sequences before bytes such as &#34;%01&#34; are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.</p> <p>Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using &#34;..%01&#34; sequences, which bypass the removal of &#34;../&#34; sequences before bytes such as &#34;%01&#34; are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2006-3392 GHSA-w4wx-r2h6-p94q https://cve.radiocsirt.org/vuln/ghsa-w4wx-r2h6-p94q <p>Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using &#34;..%01&#34; sequences, which bypass the removal of &#34;../&#34; sequences before bytes such as &#34;%01&#34; are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.</p> <p>Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using &#34;..%01&#34; sequences, which bypass the removal of &#34;../&#34; sequences before bytes such as &#34;%01&#34; are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.</p> https://cve.radiocsirt.org/vuln/ghsa-w4wx-r2h6-p94q gsd-2006-3392 https://cve.radiocsirt.org/vuln/gsd-2006-3392 gsd-2006-3392 https://cve.radiocsirt.org/vuln/gsd-2006-3392