CWE-552— Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.— MITRE CWE catalog
565 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-552page 10 of 12
- CVE-2026-58415MEDIUMCVSS 5.3EG 5.32026-10-01
Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET…
- CVE-2026-73736MEDIUMCVSS 5.3EG 5.32026-09-01
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some system files. Successful exploitation could allow an attacker to read files within the affe…
- CVE-2026-78051MEDIUMCVSS 5.3EG 5.32026-08-22
A vulnerability was determined in alexta69 MeTube up to 2026.06.10. The impacted element is an unknown function of the file /download/.metube/cookies.txt of the component Cookie File Handler. This manipulation causes files or directories a…
- CVE-2026-76799MEDIUMCVSS 5.3EG 5.32026-08-20
A weakness has been identified in code-projects Login Registration System 1.0. This affects an unknown function of the file /loginsystem/database/login_registration_system.sql of the component SQL Database Backup Handler. This manipulation…
- CVE-2026-19987MEDIUMCVSS 5.3EG 5.32026-08-17
A security vulnerability has been detected in SourceCodester Best Employee Management System 1.0. This affects an unknown function of the file /assets/uploadImage/Profile/. Such manipulation leads to exposure of information through directo…
- CVE-2026-19903MEDIUMCVSS 5.3EG 5.32026-08-15
A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Database Backup. The manipulation leads to files or directories accessible. Remote e…
- CVE-2026-13533MEDIUMCVSS 5.3EG 5.32026-06-29
A security vulnerability has been detected in agentejo Cockpit CMS up to 0.12.2. Affected by this issue is the function Spyc::YAMLLoad of the file /config/config.yaml of the component htaccess Handler. Such manipulation leads to files or d…
- CVE-2026-45543MEDIUMCVSS 5.3EG 5.32026-06-01
Nextcloud is an open source content collaboration platform. From version 4.3.0 to before version 5.2.7, a removed collaborator retains unauthorized read access to uploaded respondent files for the affected form. The scope is limited to upl…
- CVE-2026-5335MEDIUMCVSS 5.3EG 5.32026-05-04
The Magic Export & Import WordPress plugin before 1.2.0 stores exported CSV files at a publicly accessible location, making it possible for any visitors to leak sensitive user information.
- CVE-2026-4900MEDIUMCVSS 5.3EG 5.32026-03-26
A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file /dbfood/localhost.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely…
- CVE-2025-12648MEDIUMCVSS 5.3EG 5.32026-01-07
The WP-Members Membership Plugin for WordPress is vulnerable to unauthorized file access in versions up to, and including, 3.5.4.4. This is due to storing user-uploaded files in predictable directories (wp-content/uploads/wpmembers/user_fi…
- CVE-2025-14442MEDIUMCVSS 5.3EG 5.32025-12-12
The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage of exported CSV files in a publicly accessible directory with predictable filenames in all versions …
- CVE-2025-12747MEDIUMCVSS 5.3EG 5.32025-11-21
The Tainacan plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via uploaded files marked as private being exposed in wp-content without adequate protection. This makes it possible for u…
- CVE-2025-12894MEDIUMCVSS 5.3EG 5.32025-11-21
The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.17 via the import/export functionality and a lack of .htacce…
- CVE-2025-13200MEDIUMCVSS 5.3EG 5.32025-11-15
A vulnerability was determined in SourceCodester Farm Management System 1.0. Affected by this vulnerability is an unknown functionality. This manipulation causes exposure of information through directory listing. The attack is possible to …
- CVE-2025-33150MEDIUMCVSS 5.3EG 5.32025-11-10
IBM Cognos Analytics Certified Containers 12.1.0 could disclose package parameter information due to the presence of hidden pages.
- CVE-2025-58152MEDIUMCVSS 5.3EG 5.32025-10-31
FutureNet MA and IP-K series provided by Century Systems Co., Ltd. put the firmware version and the garbage collection information on the internal web page. With some crafted HTTP request, they can be accessed without authentication.
- CVE-2025-52460MEDIUMCVSS 5.3EG 5.32025-08-28
Files or directories accessible to external parties issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If exploited, uploaded files and SS1 configuration files may be accessed by a remote unauthenticated att…
- CVE-2025-43758MEDIUMCVSS 5.3EG 5.32025-08-22
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows …
- CVE-2025-43749MEDIUMCVSS 5.3EG 5.32025-08-20
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows …
- CVE-2025-4807MEDIUMCVSS 5.3EG 5.32025-05-16
A vulnerability, which was classified as problematic, was found in SourceCodester Online Student Clearance System 1.0. This affects an unknown part. The manipulation leads to exposure of information through directory listing. It is possibl…
- CVE-2025-2652MEDIUMCVSS 5.3EG 5.32025-03-23
A vulnerability has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to exposure of information…
- CVE-2025-2651MEDIUMCVSS 5.3EG 5.32025-03-23
A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /oews/admin/. The manipulation leads to exposure of information through directory listin…
- CVE-2025-2147MEDIUMCVSS 5.3EG 5.32025-03-10
A vulnerability was found in Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to files or dir…
- CVE-2024-47106MEDIUMCVSS 5.3EG 5.32025-01-18
IBM Jazz for Service Management 1.1.3 through 1.1.3.22 could allow a remote attacker to obtain sensitive information from improper access restrictions that could aid in further attacks against the system.
- CVE-2024-9945MEDIUMCVSS 5.3EG 5.32024-12-13
An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in certain admin root folders.
- CVE-2024-49756MEDIUMCVSS 5.3EG 5.32024-10-23
AshPostgres is the PostgreSQL data layer for Ash Framework. Starting in version 2.0.0 and prior to version 2.4.10, in certain very specific situations, it was possible for the policies of an update action to be skipped. This occurred only …
- CVE-2024-44807MEDIUMCVSS 5.3EG 5.32024-10-11
A directory listing issue in the baserCMS plugin in D-ZERO CO., LTD. BurgerEditor and BurgerEditor Limited Edition before 2.25.1 allows remote attackers to obtain sensitive information by exposing a list of the uploaded files.
- CVE-2024-8655MEDIUMCVSS 5.3EG 5.32024-09-10
A vulnerability was found in Mercury MNVR816 up to 2.0.1.0.5. It has been classified as problematic. This affects an unknown part of the file /web-static/. The manipulation leads to files or directories accessible. It is possible to initia…
- CVE-2024-5587MEDIUMCVSS 5.3EG 5.32024-06-02
A vulnerability was found in Casdoor up to 1.335.0. It has been classified as problematic. Affected is an unknown function of the file /conf/app.conf of the component Configuration File Handler. The manipulation leads to files or directori…
- CVE-2024-5045MEDIUMCVSS 5.3EG 5.32024-05-17
A vulnerability was found in SourceCodester Online Birth Certificate Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin. The manipulation leads to files or directories acc…
- CVE-2024-1005MEDIUMCVSS 5.3EG 5.32024-01-29
A vulnerability has been found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This vulnerability affects unknown code of the file /runtime/log. The manipulation leads to files or directories accessible. The a…
- CVE-2023-52112MEDIUMCVSS 5.3EG 5.32024-01-16
Unauthorized file access vulnerability in the wallpaper service module. Successful exploitation of this vulnerability may cause features to perform abnormally.
- CVE-2023-4933MEDIUMCVSS 5.3EG 5.32023-10-16
The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job applications, allowing unauthenticated visitors to list and download private attachments if the aut…
- CVE-2023-5101MEDIUMCVSS 5.3EG 5.32023-10-09
Files or Directories Accessible to External Parties in RDT400 in SICK APU allows an unprivileged remote attacker to download various files from the server via HTTP requests.
- CVE-2023-34834MEDIUMCVSS 5.3EG 5.32023-06-29
A Directory Browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attackers to gain sensitive information about the configured databases via the "/file" endpoint.
- CVE-2023-29107MEDIUMCVSS 5.3EG 5.32023-05-09
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The export endpoint discloses some undocumented files. This could allow an una…
- CVE-2023-22858MEDIUMCVSS 5.3EG 5.32023-03-06
An Improper Access Control vulnerability in BlogEngine.NET 3.3.8.0, allows unauthenticated visitors to access the files of unpublished blogs.
- CVE-2022-4346MEDIUMCVSS 5.3EG 5.32023-01-23
The All-In-One Security (AIOS) WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address.
- CVE-2022-43414MEDIUMCVSS 5.3EG 5.32022-10-19
Jenkins NUnit Plugin 0.27 and earlier implements an agent-to-controller message that parses files inside a user-specified directory as test results, allowing attackers able to control agent processes to obtain test results from files in an…
- CVE-2022-2834MEDIUMCVSS 5.3EG 5.32022-10-17
The Helpful WordPress plugin before 4.5.26 puts the exported logs and feedbacks in a publicly accessible location and guessable names, which could allow attackers to download them and retrieve sensitive information such as IP, Names and Em…
- CVE-2022-34049MEDIUMCVSS 5.3EG 5.32022-07-20
An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows unauthenticated attackers to download log files and configuration data.
- CVE-2022-25497MEDIUMCVSS 5.3EG 5.32022-03-15
CuppaCMS v1.0 was discovered to contain an arbitrary file read via the copy function.
- CVE-2021-33843MEDIUMCVSS 5.3EG 5.32022-01-21
Fresenius Kabi Agilia SP MC WiFi vD25 and prior has a default configuration page accessible without authentication. An attacker may use this functionality to change the exposed configuration values such as network settings.
- CVE-2019-3897MEDIUMCVSS 5.3EG 5.32021-03-16
It has been discovered in redhat-certification that any unauthorized user may download any file under /var/www/rhcert, provided they know its name. Red Hat Certification 6 and 7 is vulnerable to this issue.
- CVE-2020-35658MEDIUMCVSS 5.3EG 5.32020-12-23
SpamTitan before 7.09 allows attackers to tamper with backups, because backups are not encrypted.
- CVE-2020-13953MEDIUMCVSS 5.3EG 5.32020-09-30
In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.
- CVE-2019-20593MEDIUMCVSS 5.3EG 5.32020-03-24
An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. Gallery leaks Private Mode thumbnails. The Samsung ID is SVE-2019-14208 (July 2019).
- CVE-2020-10105MEDIUMCVSS 5.3EG 5.32020-03-05
An issue was discovered in Zammad 3.0 through 3.2. It returns source code of static resources when submitting an OPTIONS request, rather than a GET request. Disclosure of source code allows for an attacker to formulate more precise attacks…
- CVE-2019-14273MEDIUMCVSS 5.3EG 5.32019-09-26
In SilverStripe assets 4.0, there is broken access control on files.
Map vulnerabilities like CWE-552 to your infrastructure
EchelonGraph correlates every CVE — across CWE-552 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →