Approved changes feed: RSS · Atom
cpe:2.3:a:pf4j_project:pf4j:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Pf4J Project (1f9bd0e3-859b-5224-84d8-21cb79a9a970) |
|---|---|
| Product | Pf4J (8341e421-e868-576f-b9c4-b015ac576867) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/pf4j/pf4j |
purl2cpe | 2026-06-01 10:16:42.974462 |
pkg:maven/org.pf4j/pf4j |
purl2cpe | 2026-06-01 10:16:42.974464 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-70952 |
vulnerable | 2026-06-08 07:43:17.066412 |
Details available
pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation.
Published: 2026-03-25T00:00:00.000Z
Updated: 2026-03-28T01:20:21.432Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-40828 |
vulnerable | 2026-06-08 06:11:04.650393 |
Details available
An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIfZip method in the extract function.
Published: 2023-08-28T00:00:00.000Z
Updated: 2024-10-02T13:56:55.608Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-40827 |
vulnerable | 2026-06-08 06:11:04.649892 |
Details available
An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluginPath parameter.
Published: 2023-08-28T00:00:00.000Z
Updated: 2024-10-02T15:18:32.531Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-40826 |
vulnerable | 2026-06-08 06:11:04.649305 |
Details available
An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the zippluginPath parameter.
Published: 2023-08-28T00:00:00.000Z
Updated: 2024-10-02T15:21:54.380Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.