EUVD-2026-95336

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory...

EUVD-2026-95350

Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that allows authenticated users to delete other users' subscriptions by ID. Attackers can submit a delete action to /account/protected/sub/subSaveAction with another user's...

PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass

Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass Summary praisonai-platform lets an ordinary workspace member patch owner-created project, issue, and agent records even though the paired delete routes enforce owner/admin authorization. For...

EUVD-2026-42899

PraisonAI: Shell command allowlist bypass via find -exec built-in action...

EUVD-2026-44644

PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization...

CVE-2026-107793 Jivejdon through 5.0 IDOR via subSaveAction Subscription Delete

Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that allows authenticated users to delete other users' subscriptions by ID. Attackers can submit a delete action to /account/protected/sub/subSaveAction with another user's...

CVE-2026-107793

The Jivejdon software (through version 5.0 ) contains an authorization bypass vulnerability in the SubscriptionServiceImp.deleteSubscription component. This flaw allows authenticated users to perform an Insecure Direct Object Reference (IDOR) by submitting a delete action to the /account/protecte...

CVE-2026-82900

IBM Guardium Data Protection versions 12.2.2 and 12.1 are affected by a vulnerability that could allow a remote attacker to delete arbitrary files. This issue is caused by an improper limitation of a pathname to a restricted directory (CWE-22). The impact is characterized by high consequences for...

s3sec

s3sec Test AWS S3 buckets for read/write/delete access This tool was developed to quickly test a list of s3 buckets for public read, write and delete access for the purposes of penetration testing on bug bounty programs. Screenshot Found a bug bounty using this tool? Feel free to add me as a...

s3sec

s3sec AWS S3バケットの読み取り/書き込み/削除アクセスをテストする このツールは、バグバウンティプログラムにおけるペネトレーションテストのために、S3バケットのパブリックな読み取り、書き込み、削除アクセスを迅速にテストするために開発されました。 Screenshot このツールを使ってバグバウンティを見つけましたか？ お気軽にコラボレーターとして追加してください: @0xmoot : インストール gitリポジトリを自分のマシンにクローンします: git clone https://github.com/0xmoot/s3sec 楽しいハンティングを : 使い方...

CVE-2026-7028-SQLI

CodeAstro-Online-Job-Portal-SQLi-Delete-All 詳細 ベンダー: CodeAstro 製品: Online Job Portal Project in PHP MySQL バージョン: 1.0 脆弱性タイプ: SQLインジェクション CWE: CWE-89 影響を受けるエンドポイント: /admin/jobs-admins/delete-jobs.php パラメータ: id GET 影響: データベース内のすべての求人レコードの削除が可能 説明 CodeAstro Online Job...

CVE-2026-107637

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper authorization vulnerability in the note module delete action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remov...

EUVD-2026-95024

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper authorization vulnerability in the note module delete action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remov...

CVE-2026-107637 pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper authorization vulnerability in the note module delete action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remov...

CVE-2026-107637 pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper authorization vulnerability in the note module delete action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remov...

CVE-2026-107637

pH7Builder (pH7 Social Dating CMS) versions prior to 18.5.0 are vulnerable to an improper authorization flaw within the note module delete() action . The root cause is a lack of profile ID checks in the database queries, which allows authenticated members to delete note comments and categories be...

CVE-2025-21420_POC

cleanmgr.exe 디핑 새로운 버전의 cleanmgr.exe에는 SetProcessMitigationPolicy 함수 호출이 포함되어 있습니다. MitigationPolicy가 16으로 설정되어 있으며, 이는 ProcessRedirectionTrustPolicy 에 해당합니다. Microsoft의 CWE-59: 파일 액세스 전 부적절한 링크 확인'Link Following' 설명과 함께 보면, cleanmgr.exe에 Redirection Guard가 활성화되어 있음을 추론할 수 있습니다. Simon Zuckerbraun...

delete-self-poc

🗑️ delete-self-poc delete-self-poc 演示了一种从磁盘删除被锁定或当前正在运行的文件的方法。此概念最初由 Jonas Lykkegaard 发现，我为此创建了概念验证（POC）。此外，只要当前调用进程具有访问和删除这些文件的必要权限，它也可以用于删除磁盘上被锁定的文件。 那么这个 POC 是如何工作的呢？ 1. 打开当前运行进程的 HANDLE，并具有 DELETE 访问权限。请注意，仅需要 DELETE 访问权限。 2. 使用 SetFileInformationByHandle 函数将主文件流 :$DATA 重命名为 :wtfbbq。 3. 关闭...

firehol

FireHOL http://firehol.org/ FireHOL, an iptables stateful packet filtering firewall for humans! FireQOS, a TC based bandwidth shaper for humans! Git These instructions are for people who are working with the git repository. There are more general instructions starting with Upgrade Notes. Cloning...

CVE-2026-105260

The Database Addon For WPForms wpforms entries WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted and performs no capability check of its own, allowing attackers to delete arbitrary stored form entries by tricking a logged-in administrator into loading a crafte...