# CWE-548. Every Advisory and CVE whose sources give the weakness CWE-548, newest first. ## Records, newest first - [Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret](https://agentprime.io/advisories/CVE-2026-82976.md) `CVE-2026-82976` · CVE record: Red Hat Red Hat OpenShift Container Platform 4 and 1 more · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-548 - [An exposure of information through directory listing issue exists in CONPROSYS PAC Series.](https://agentprime.io/advisories/CVE-2026-82778.md) `CVE-2026-82778` · CVE record: Contec Co., Ltd. Integrated Type CPS-PC341\[\]\[\]-\*-9201 and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-548 - [An exposure of information through directory listing issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series.](https://agentprime.io/advisories/CVE-2026-82775.md) `CVE-2026-82775` · CVE record: Contec Co., Ltd. M2M Gateway Integrated Type CPS-MG341\* and 3 more · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-548 - [SourceCodester Best Employee Management System Profile exposure of information through directory listing](https://agentprime.io/advisories/CVE-2026-19987.md) `CVE-2026-19987` · CVE record: SourceCodester Best Employee Management System · CVSS 6.9 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Information disclosure, CWE-548 - [Lyrion Music Server 9.2.0 Arbitrary Directory Listing](https://agentprime.io/advisories/CVE-2026-50233.md) `CVE-2026-50233` · CVE record: LMS Community Lyrion Music Server · CVSS 6.9 Medium · Not analysed yet · Published 5 Jun 2026 · Tags: CWE-548 - [Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability.](https://agentprime.io/advisories/CVE-2025-32750.md) `CVE-2025-32750` · CVE record: Dell PowerFlex Manager (Appliance) and 2 more · CVSS 7.5 High · Not analysed yet · Published 20 May 2026 · Tags: CWE-548 - [Vvveb < 1.0.8.3 Directory Listing Information Disclosure](https://agentprime.io/advisories/CVE-2026-41933.md) `CVE-2026-41933` · CVE record: givanz Vvveb · CVSS 6.9 Medium · Not analysed yet · Published 14 May 2026 · Tags: CWE-548 - [Improper Access Control and Exposure of Information Through Directory Listing vulnerabilities affect IBM Cloud Pak System\[, \]](https://agentprime.io/advisories/CVE-2023-38265.md) `CVE-2023-38265` · CVE record: IBM Cloud Pak System · CVSS 5.3 Medium · Not analysed yet · Published 17 Feb 2026 · Tags: CWE-548 - [Rack has a Directory Traversal via Rack:Directory](https://agentprime.io/advisories/GHSA-mxw3-3hh2-x2mh.md) `GHSA-mxw3-3hh2-x2mh`, `CVE-2026-22860` · RubyGems `rack`: affected `<2.2.22 || >=3.0.0.beta1, <3.1.20 || >=3.2.0, <3.2.5`, fixed in `2.2.22`, `3.1.20`, `3.2.5` · CVSS 7.5 High · Not analysed yet · Published 17 Feb 2026 · Tags: Path traversal, CWE-548 - [RED-V Super Digital Signage System 5.1.1 Log Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2020-36921.md) `CVE-2020-36921` · CVE record: RED RED-V Super Digital Signage System RXV-A740R · CVSS 6.9 Medium · Not analysed yet · Published 6 Jan 2026 · Tags: CWE-548 - [SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Information Disclosure via Log Directory](https://agentprime.io/advisories/CVE-2022-50788.md) `CVE-2022-50788` · CVE record: SOUND4 Ltd. Impact/Pulse/First and 4 more · CVSS 6.9 Medium · Not analysed yet · Published 30 Dec 2025 · Tags: CWE-548 - [OpenBMCS Directory Listing Information Disclosure](https://agentprime.io/advisories/CVE-2021-47718.md) `CVE-2021-47718` · CVE record: OPEN BMCS OpenBMCS · CVSS 8.7 High · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-548 - [IBM QRadar SIEM is affected by an information disclosure vulnerability](https://agentprime.io/advisories/CVE-2024-56464.md) `CVE-2024-56464` · CVE record: IBM IBM QRadar SIEM · CVSS 2.7 Low · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-548 - [SourceCodester Farm Management System exposure of information through directory listing](https://agentprime.io/advisories/CVE-2025-13200.md) `CVE-2025-13200` · CVE record: SourceCodester Farm Management System · CVSS 6.9 Medium · Not analysed yet · Published 15 Nov 2025 · Tags: Information disclosure, CWE-548 - [Moodle's error handling leads to sensitive information disclosure](https://agentprime.io/advisories/GHSA-c5cj-xp43-qcc3.md) `GHSA-c5cj-xp43-qcc3`, `BIT-moodle-2025-62396`, `CVE-2025-62396`, `PKSA-s9t3-1mh7-mgx2` · Packagist `moodle/moodle`: affected `>=4.5.0-beta, <4.5.7 || >=5.0.0-beta, <5.0.3`, fixed in `4.5.7`, `5.0.3` · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2025 · Tags: CWE-548 - [IBM Content Navigator information disclosure](https://agentprime.io/advisories/CVE-2025-27906.md) `CVE-2025-27906` · CVE record: IBM Content Navigator · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: CWE-548 - [Mastra Docs MCP Server \`@mastra/mcp-docs-server\` Leads to Information Exposure](https://agentprime.io/advisories/GHSA-xh92-rqrq-227v.md) `GHSA-xh92-rqrq-227v`, `CVE-2025-61685` · npm `@mastra/mcp-docs-server`: affected `<0.17.0`, fixed in `0.17.0` · CVSS 6.5 Medium · Not analysed yet · Published 24 Sept 2025 · Tags: CWE-548 - [Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control.](https://agentprime.io/advisories/CVE-2025-28170.md) `CVE-2025-28170` · CVE record · CVSS 7.6 High · Not analysed yet · Published 29 Jul 2025 · Tags: CWE-548 - [IBM Sterling File Gateway information disclosure](https://agentprime.io/advisories/CVE-2025-2827.md) `CVE-2025-2827` · CVE record: IBM Sterling File Gateway · CVSS 4.3 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: CWE-548 - [CVE-2025-27452](https://agentprime.io/advisories/CVE-2025-27452.md) `CVE-2025-27452` · CVE record: Endress+Hauser Endress+Hauser MEAC300-FNADE4 · CVSS 5.3 Medium · Not analysed yet · Published 3 Jul 2025 · Tags: CWE-548 - [SourceCodester Client Database Management System exposure of information through directory listing](https://agentprime.io/advisories/CVE-2025-4909.md) `CVE-2025-4909` · CVE record: SourceCodester Client Database Management System · CVSS 6.9 Medium · Not analysed yet · Published 19 May 2025 · Tags: Information disclosure, CWE-548 - [SourceCodester Online Student Clearance System exposure of information through directory listing](https://agentprime.io/advisories/CVE-2025-4807.md) `CVE-2025-4807` · CVE record: SourceCodester Online Student Clearance System · CVSS 6.9 Medium · Not analysed yet · Published 16 May 2025 · Tags: Information disclosure, CWE-548 - [IBM Information Server information disclosure](https://agentprime.io/advisories/CVE-2025-1138.md) `CVE-2025-1138` · CVE record: IBM InfoSphere Information Server · CVSS 4.3 Medium · Not analysed yet · Published 15 May 2025 · Tags: CWE-548 - [A Directory Listing Vulnerability was found in the /osms/Requester/ directory of the Kashipara Online Service Management Portal V1.0.](https://agentprime.io/advisories/CVE-2025-45320.md) `CVE-2025-45320` · CVE record · CVSS 7.5 High · Not analysed yet · Published 5 May 2025 · Tags: CWE-548 - [Dell PowerScale OneFS: Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.0…](https://agentprime.io/advisories/CVE-2025-23378.md) `CVE-2025-23378` · CVE record: Dell PowerScale OneFS · CVSS 3.3 Low · Not analysed yet · Published 10 Apr 2025 · Tags: CWE-548 - [SourceCodester Employee and Visitor Gate Pass Logging System exposure of information through directory listing](https://agentprime.io/advisories/CVE-2025-2652.md) `CVE-2025-2652` · CVE record: SourceCodester Employee and Visitor Gate Pass Logging System · CVSS 6.9 Medium · Not analysed yet · Published 23 Mar 2025 · Tags: Information disclosure, CWE-548 - [SourceCodester Online Eyewear Shop admin exposure of information through directory listing](https://agentprime.io/advisories/CVE-2025-2651.md) `CVE-2025-2651` · CVE record: SourceCodester Online Eyewear Shop · CVSS 6.9 Medium · Not analysed yet · Published 23 Mar 2025 · Tags: Information disclosure, CWE-548 - [code-projects Blood Bank Management System upload exposure of information through directory listing](https://agentprime.io/advisories/CVE-2025-2038.md) `CVE-2025-2038` · CVE record: code-projects Blood Bank Management System · CVSS 6.9 Medium · Not analysed yet · Published 6 Mar 2025 · Tags: Information disclosure, CWE-548 - [IBM Security Directory Integrator information disclosure](https://agentprime.io/advisories/CVE-2024-28766.md) `CVE-2024-28766` · CVE record: IBM Security Directory Integrator and 1 more · CVSS 2.4 Low · Not analysed yet · Published 27 Jan 2025 · Tags: CWE-548 - [IBM Control Center information disclosure](https://agentprime.io/advisories/CVE-2024-35113.md) `CVE-2024-35113` · CVE record: IBM Control Center · CVSS 4.3 Medium · Not analysed yet · Published 25 Jan 2025 · Tags: CWE-548 - [@saltcorn/server arbitrary file and directory listing when accessing build mobile app results](https://agentprime.io/advisories/GHSA-cfqx-f43m-vfh7.md) `GHSA-cfqx-f43m-vfh7` · npm `@saltcorn/server`: affected `<1.0.0-beta.14`, fixed in `1.0.0-beta.14` · CVSS 4.9 Medium · Not analysed yet · Published 3 Oct 2024 · Tags: CWE-548 - [SourceCodester Food Ordering Management System includes exposure of information through directory listing](https://agentprime.io/advisories/CVE-2024-8711.md) `CVE-2024-8711` · CVE record: SourceCodester Food Ordering Management System · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2024 · Tags: CWE-548 - [IBM Aspera Faspex information disclosure](https://agentprime.io/advisories/CVE-2024-45096.md) `CVE-2024-45096` · CVE record: IBM Aspera Faspex · CVSS 6.5 Medium · Not analysed yet · Published 5 Sept 2024 · Tags: CWE-548 - [CodeAstro Online Railway Reservation System assets exposure of information through directory listing](https://agentprime.io/advisories/CVE-2024-7912.md) `CVE-2024-7912` · CVE record: CodeAstro Online Railway Reservation System · CVSS 6.9 Medium · Not analysed yet · Published 18 Aug 2024 · Tags: CWE-548 - [SourceCodester Online Graduate Tracer System nbproject exposure of information through directory listing](https://agentprime.io/advisories/CVE-2024-7809.md) `CVE-2024-7809` · CVE record: SourceCodester Online Graduate Tracer System · CVSS 6.9 Medium · Not analysed yet · Published 15 Aug 2024 · Tags: CWE-548 - [SPX (aka php-spx) through 0.4.15 allows SPX_UI_URI Directory Traversal to read arbitrary files.](https://agentprime.io/advisories/CVE-2024-42007.md) `CVE-2024-42007` · CVE record · CVSS 5.8 Medium · Not analysed yet · Published 26 Jul 2024 · Tags: Path traversal, CWE-548 - [Exposure of Information Through Directory Listing vulnerability in OpenGnsys](https://agentprime.io/advisories/CVE-2024-3707.md) `CVE-2024-3707` · CVE record: OpenGnsys OpenGnsys · CVSS 5.3 Medium · Not analysed yet · Published 12 Apr 2024 · Tags: CWE-548 - [Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing](https://agentprime.io/advisories/CVE-2024-2340.md) `CVE-2024-2340` · CVE record: ThemeFusion Avada | Website Builder For WordPress & WooCommerce · CVSS 5.3 Medium · EPSS 0.28 · Not analysed yet · Published 9 Apr 2024 · Tags: CWE-548 - [An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before.](https://agentprime.io/advisories/CVE-2024-22082.md) `CVE-2024-22082` · CVE record · CVSS 7.5 High · Not analysed yet · Published 20 Mar 2024 · Tags: CWE-548 - [A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requiring authorization.](https://agentprime.io/advisories/CVE-2023-49979.md) `CVE-2023-49979` · CVE record · CVSS 7.5 High · Not analysed yet · Published 6 Mar 2024 · Tags: CWE-548 - [A Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to list the files hosted by the web application.](https://agentprime.io/advisories/CVE-2023-51948.md) `CVE-2023-51948` · CVE record · CVSS 7.5 High · Not analysed yet · Published 19 Jan 2024 · Tags: CWE-548 - [Directory Traversal on Shop Beat Services](https://agentprime.io/advisories/CVE-2022-36243.md) `CVE-2022-36243` · CVE record: Shop Beat studio · CVSS 5.3 Medium · Not analysed yet · Published 30 May 2023 · Tags: CWE-548 - [tombh jekbox server.rb exposure of information through directory listing](https://agentprime.io/advisories/CVE-2016-15019.md) `CVE-2016-15019` · CVE record: tombh jekbox · CVSS 4.3 Medium · Not analysed yet · Published 15 Jan 2023 · Tags: CWE-548 - [saxman maps-js-icoads exposure of information through directory listing](https://agentprime.io/advisories/CVE-2014-125069.md) `CVE-2014-125069` · CVE record: saxman maps-js-icoads · CVSS 4.3 Medium · Not analysed yet · Published 8 Jan 2023 · Tags: CWE-548 - [Pentaho Business Analytics Server - Exposure of Information Through Directory Listing](https://agentprime.io/advisories/CVE-2021-45446.md) `CVE-2021-45446` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 5.0 Medium · Not analysed yet · Published 2 Nov 2022 · Tags: CWE-548 - [Chcnav - P5E GNSS Directory listing](https://agentprime.io/advisories/CVE-2022-30625.md) `CVE-2022-30625` · CVE record: Chcnav Chcnav - P5E GNSS · CVSS 5.7 Medium · Not analysed yet · Published 18 Jul 2022 · Tags: CWE-548 - [mySCADA myPRO Exposure of Information Through Directory Listing](https://agentprime.io/advisories/CVE-2021-27505.md) `CVE-2021-27505` · CVE record: mySCADA myPRO · CVSS 7.5 High · Not analysed yet · Published 13 May 2022 · Tags: CWE-548 - [Fresenius Kabi Agilia Connect Infusion System exposure of information through directory listing](https://agentprime.io/advisories/CVE-2021-23195.md) `CVE-2021-23195` · CVE record: Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) · CVSS 5.3 Medium · Not analysed yet · Published 21 Jan 2022 · Tags: CWE-548 - [Dell PowerScale OneFS: Dell EMC PowerScale OneFS versions 9.1.0, 9.2.0.x…](https://agentprime.io/advisories/CVE-2021-21528.md) `CVE-2021-21528` · CVE record: Dell PowerScale OneFS · CVSS 7.5 High · Not analysed yet · Published 12 Nov 2021 · Tags: CWE-548 - [QSAN Storage Manager - Exposure of Information Through Directory Listing](https://agentprime.io/advisories/CVE-2021-32515.md) `CVE-2021-32515` · CVE record: QSAN Storage Manager · CVSS 5.3 Medium · Not analysed yet · Published 7 Jul 2021 · Tags: CWE-548 - [QSAN Storage Manager - Exposure of Information Through Directory Listing Following via ViewBroserList function](https://agentprime.io/advisories/CVE-2021-32511.md) `CVE-2021-32511` · CVE record: QSAN Storage Manager · CVSS 4.3 Medium · Not analysed yet · Published 7 Jul 2021 · Tags: CWE-548 - [QSAN Storage Manager - Exposure of Information Through Directory Listing Following via Antivirus function](https://agentprime.io/advisories/CVE-2021-32510.md) `CVE-2021-32510` · CVE record: QSAN Storage Manager · CVSS 4.3 Medium · Not analysed yet · Published 7 Jul 2021 · Tags: CWE-548 - [AquaNPlayer directory traversing vulnerability](https://agentprime.io/advisories/CVE-2020-7858.md) `CVE-2020-7858` · CVE record: cdnetworks AquaNPlayer · CVSS 6.8 Medium · Not analysed yet · Published 22 Apr 2021 · Tags: CWE-548 - [A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP8).](https://agentprime.io/advisories/CVE-2020-15790.md) `CVE-2020-15790` · CVE record: Siemens AG Spectrum Power 4 · No CVSS score · Not analysed yet · Published 9 Sept 2020 · Tags: CWE-548 - [Directory traversal in Rack::Directory app bundled with Rack](https://agentprime.io/advisories/GHSA-5f9h-9pjv-v6j7.md) `GHSA-5f9h-9pjv-v6j7`, `CVE-2020-8161` · RubyGems `rack`: affected `<2.1.3`, fixed in `2.1.3` · CVSS 8.6 High · Not analysed yet · Published 6 Jul 2020 · Tags: Path traversal, CWE-548 - [Information exposure in the upload directory in PrestaShop](https://agentprime.io/advisories/CVE-2020-15081.md) `CVE-2020-15081` · CVE record: PrestaShop PrestaShop · CVSS 5.3 Medium · Not analysed yet · Published 2 Jul 2020 · Tags: CWE-548 - [Unauthorized File Access in harp](https://agentprime.io/advisories/GHSA-46hv-7769-j7rx.md) `GHSA-46hv-7769-j7rx`, `CVE-2019-5437` · npm `harp`: affected `<0.40.2`, fixed in `0.40.2` · CVSS 5.3 Medium · Not analysed yet · Published 13 Jun 2019 · Tags: CWE-548 - [Path Traversal in serve](https://agentprime.io/advisories/GHSA-v588-qcp3-jv46.md) `GHSA-v588-qcp3-jv46`, `CVE-2019-5415` · npm `serve`: affected `<7.0.0`, fixed in `7.0.0` · CVSS 7.5 High · Not analysed yet · Published 25 Mar 2019 · Tags: CWE-548 - [Path Traversal in simplehttpserver](https://agentprime.io/advisories/GHSA-45j8-pm75-5v8x.md) `GHSA-45j8-pm75-5v8x`, `CVE-2018-16493` · npm `static-resource-server`: affected `<=1.7.2`, no fixed version yet · No CVSS score · Not analysed yet · Published 7 Feb 2019 · Tags: CWE-548 - [NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior.](https://agentprime.io/advisories/CVE-2018-14785.md) `CVE-2018-14785` · CVE record: ICS-CERT NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. · No CVSS score · Not analysed yet · Published 10 Aug 2018 · Tags: CWE-548 Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .