Use of Incorrectly-Resolved Name or Reference
CWE-706
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
We track 65 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.6. 3 have been exploited in real attacks.
Latest Use of Incorrectly-Resolved Name or Reference vulnerabilities
- 7.6 High severity
WeKnora: Use of Incorrectly-Resolved Name or Reference
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a vulnerability involving tool name collision and indirect prompt injection allows a malicious remote MCP server to hijack tool executi
- 8.1 High severity
filebrowser: Incorrect Authorization
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, an authenticated user can bypass the application's "Disallow" file path rules by modifying the r
- 9.8 Critical severity
Easyimages2.0: Use of Incorrectly-Resolved Name or Reference
An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via renaming a PHP file to a SVG format.
- 7.5 High severity
hono: Use of Incorrectly-Resolved Name or Reference
Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location blo
- 9.8 Critical severity
Niagara Framework: Use of Incorrectly-Resolved Name or Reference
Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1,
- 8.8 High severity
Mortgage Calculator Estatik: Use of Incorrectly-Resolved Name or Reference
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Estatik Mortgage Calculator Estatik estatik-mortgage-calculator allows PHP Local File Inclusion.This issue affects Mortgage Calculator Esta
- 9.8 Critical severity
WP Travel Engine: Use of Incorrectly-Resolved Name or Reference
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue affects WP Travel Engine: from n/a through <=
- 9.8 Critical severity
Essential Real Estate: Use of Incorrectly-Resolved Name or Reference
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Essential Real Estate essential-real-estate allows PHP Local File Inclusion.This issue affects Essential Real Estate: from n/a thro
- 9.8 Critical severity
Apache Tomcat Path Equivalence Exploited
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 th
- 9.8 Critical severity
Cryptocurrency Widgets For Elementor: Use of Incorrectly-Resolved Name or Reference
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Cool Plugins Cryptocurrency Widgets For Elementor cryptocurrency-widgets-for-elementor allows PHP Local File Inclusion.This issue affects C
- 9.8 Critical severity
serve: Use of Incorrectly-Resolved Name or Reference
TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. TorchServe 's check on allowed_urls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being down
- 7.5 High severity
Qi Addons For Elementor: Use of Incorrectly-Resolved Name or Reference
The Qi Addons For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.2 via the 'behavior' attributes found in the qi_addons_for_elementor_blog_list shortcode. This makes it possible for authenticated
- 7.8 High severity
Premium Security: Improper Link Resolution Before File Access
Avast Premium Security Sandbox Protection Link Following Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avast Premium Security. An attacker must first obtain the ability to exec
- 7.5 High severity
docassemble: Use of Incorrectly-Resolved Name or Reference
Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been
- 8.2 High severity
directus: Use of Incorrectly-Resolved Name or Reference
Directus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the Directus backend allows attackers to receive a password reset email of a victim user, specifically having it arrive at a similar email address
- 7.5 High severity
mastodon: Use of Incorrectly-Resolved Name or Reference
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Version
- 7.5 High severity
vite: Use of Incorrectly-Resolved Name or Reference
Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (`server.fs.deny`) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the Vite root-path of the
- 8.8 High severity
security-advisories: Use of Incorrectly-Resolved Name or Reference
Nextcloud server is an open source home cloud implementation. In affected versions when a recipient receives 2 shares with the same name, while a memory cache is configured, the second share will replace the first one instead of being renamed to `{name} (2)`.
- 7.0 High severity
Runc: Use of Incorrectly-Resolved Name or Reference
runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom i
- 9.8 Critical severity
DNS Server: Use of Incorrectly-Resolved Name or Reference
An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects o
- 9.8 Critical severity
DNS Server: Use of Incorrectly-Resolved Name or Reference
An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V1 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects o
- 7.5 High severity
parse-server: Unchecked Return Value
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server ins
- 8.1 High severity
https://github.com/curl/curl: Use of Incorrectly-Resolved Name or Reference
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.
- 9.8 Critical severity
Zoho ManageEngine ADSelfService Plus Authentication Bypass Exploited
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
- 9.8 Critical severity
Ivanti MobileIron Multiple Products Remote Code Execution Exploited
A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database (R