CVE-2025-46441 – CTLTWP Section Widget Path Traversal Vulnerability

May 19, 2025

CVE ID : CVE-2025-46441

Published : May 19, 2025, 8:15 p.m. | 2 hours, 33 minutes ago

Description : Path Traversal: ‘…/…//’ vulnerability in ctltwp Section Widget allows Path Traversal.This issue affects Section Widget: from n/a through 3.3.1.

Severity: 5.3 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Source: Read More

Previous ArticleCVE-2025-47935 – Multer Resource Exhaustion and Memory Leak Vulnerability

Next Article CVE-2025-39402 – Mojoomla WPAMS Unrestricted File Upload Remote Code Execution

Highlights

CVE-2025-46571 – Open WebUI Unauthenticated JavaScript File Upload to Admin RCE

May 5, 2025

CVE ID : CVE-2025-46571

Published : May 5, 2025, 7:15 p.m. | 18 minutes ago

Description : Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.6, low privileged users can upload HTML files which contain JavaScript code via the `/api/v1/files/` backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user’s browser. Under the default settings, files uploaded by low-privileged users can only be viewed by admins or themselves, limiting the impact of this vulnerability. A link to such a file can be sent to an admin, and if clicked, will give the low-privileged user complete control over the admin’s account, ultimately enabling RCE via functions. Version 0.6.6 contains a fix for the issue.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

The Double-Edged Sustainability Sword Of AI In Web Design

Top 12 Reasons Enterprises Choose Node.js Development Services for Scalable Growth

GitHub’s coding agent can now be launched from anywhere on platform using new Agents panel

Stop writing tests: Automate fully with Generative AI

I’m a diehard Pixel fan, but I’m not upgrading to the Pixel 10. Here’s why

Google Pixel Watch 4 vs. Samsung Galaxy Watch 8: I compared the two best Androids, and here’s the winner

Get a free Amazon gift card up to $300 when you preorder a new Google Pixel 10 phone – here’s how

Everything announced at Made by Google 2025: Pixel 10 Pro, Fold, Watch 4, and more

Copy Errors as Markdown to Share With AI in Laravel 12.25

Copy Errors as Markdown to Share With AI in Laravel 12.25

Deconstructing the Request Lifecycle in Sitecore Headless – Part 2: SSG and ISR Modes in Next.js

Susan Etlinger, AI Analyst and Industry Watcher on Building Trust

TerraMaster D1 SSD Plus Review: Experience a Faster External SSD

TerraMaster D1 SSD Plus Review: Experience a Faster External SSD

Microsoft is investigating Windows 11 KB5063878 SSD data corruption/failure issue

Microsoft Surface Won’t Turn On: 6 Tested Solutions to Fix

CVE-2025-46441 – CTLTWP Section Widget Path Traversal Vulnerability

DOJ Charges 22-Year-Old for Running RapperBot Botnet Behind 370,000 DDoS Attacks

He Hacked McDonald’s for Free Nuggets — What He Found Was Far More Dangerous

CVE-2025-52938 – NotepadNext Lua Engine Out-of-bounds Read Vulnerability

CVE-2025-6426 – “Firefox macOS Terminal File Warning Vulnerability”

CVE-2025-2907 – WordPress Order Delivery Date Plugin Authentication Bypass and CSRF Vulnerability

Rilasciata RefreshOS 2.5: La distribuzione GNU/Linux basata su Debian per tutti

CVE-2025-46571 – Open WebUI Unauthenticated JavaScript File Upload to Admin RCE

OpenAI wants ChatGPT to be your ‘super assistant’ – what that means

DistroWatch Weekly, Issue 1133

Language Models Know More Than They Show: Exploring Hallucinations From the Model’s Viewpoint

CVE-2025-46441 – CTLTWP Section Widget Path Traversal Vulnerability

Related Posts