Skip to content
OpenAdvisories

Weakness (CWE)

CWE-706: Use of Incorrectly-Resolved Name or Reference

Class Incomplete

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Source: MITRE CWE-706

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-92262 Public exploit

    MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encod…

    MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu
  • High 8.1
    CVE-2026-25890 Public exploit

    File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL

    File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, an authenticated user can bypass the application's "Disallow" file path rules by modifying the …

    filebrowser filebrowser github.com/filebrowser/filebrowser/v2 github.com/filebrowser/filebrowser Go
  • High 8.8
    CVE-2014-125125 Public exploit

    A10 Networks AX Loadbalancer Path Traversal

    A path traversal vulnerability exists in A10 Networks AX Loadbalancer versions 2.6.1-GR1-P5, 2.7.0, and earlier. The vulnerability resides in the handling of the filename parameter in the /xml/downloads endpoint, which fails to properly sanitize user input. A…

    A10 Networks AX Series Loadbalancer
  • Medium 4.9
    CVE-2024-57785 Public exploit

    Zenitel AlphaWeb XE v11.2.3.10 was discovered to contain a local file inclusion vulnerability via the component amc_upl…

  • High 7.5
    CVE-2024-27292 Public exploit EPSS 69%

    Docassemble unauthorized access through URL manipulation

    Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been…

    jhpyle docassemble docassemble-webapp docassemble-base PyPI
  • Critical 9.8
    CVE-2021-40539 Exploited · Ransomware Public exploit EPSS 99%

    Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with result…

    KEV Nov 3, 2021
  • High 8.1
    CVE-2021-39156 Public exploit

    Fragments in Path May Lead to Authorization Policy Bypass

    Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitabl…

    istio istio istio.io/istio Go
  • High 7.3
    CVE-2020-26233 Public exploit

    Remote Code Execution in Git Credential Manager Core

    Git Credential Manager Core (GCM Core) is a secure Git credential helper built on .NET Core that runs on Windows and macOS. In Git Credential Manager Core before version 2.0.289, when recursively cloning a Git repository on Windows with submodules, Git will f…

    Microsoft Git-Credential-Manager-Core
  • Critical 9.8
    CVE-2020-15505 Exploited Public exploit EPSS 100%

    A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,…

    KEV Nov 3, 2021