CVE-2021-20127

An arbitrary file deletion vulnerability exists in the file delete functionality of the Html5Servlet endpoint of Draytek VigorConnect 1.6.0-B3. This allows an authenticated user to arbitrarily delete files in any location on the target operating system with root privileges...

CVE-2021-20127

An arbitrary file deletion vulnerability exists in the file delete functionality of the Html5Servlet endpoint of Draytek VigorConnect 1.6.0-B3. This allows an authenticated user to arbitrarily delete files in any location on the target operating system with root privileges...

CVE-2021-20127

CVE-2021-20127 affects DrayTek VigorConnect (version 1.6.0-B3) via the Html5Servlet endpoint’s file deletion feature. An authenticated user can arbitrarily delete files anywhere on the target OS with root privileges, enabling high-impact disruption and potential data loss. The vulnerability stems...

CVE-2018-20127

zzzphp cms 1.5.8 contains a flaw in the del_file function of /admin/save.php that permits remote deletion of arbitrary files via a mixed-case extension and an extra '.' character (e.g., path=F:/1.phP.). Root cause: improper validation of file extensions and path syntax leads to arbitrary file del...