The vulnerability of the platform for creating individual web applications in CRM involves an incorrect restriction on the path to the catalog, allowing attackers to delete arbitrary files.

The vulnerability of the platform for creating individual web applications in CRM involves incorrect restrictions on the path to the catalog. Exploiting this vulnerability could allow a malicious actor to delete arbitrary files remotely...

The vulnerability of the Enlogic SCADA system’s virtual controller “ENTEK” arises from improper external control of file names or paths, allowing attackers to delete arbitrary files.

The vulnerability of the Enlogic SCADA system “ENTEK”’s virtual controller is related to incorrect external control using filenames or paths. Exploiting this vulnerability could allow a malicious actor to delete any files at will...

CVE-2026-4350

CVE-2026-4350 - Perfmatters WordPress 任意ファイル削除 説明 CVE-2026-4350 は、Perfmatters WordPress プラグインにおける任意ファイル削除の脆弱性です。 CVE 詳細 CVE: CVE-2026-4350 深刻度: HIGH CVSS: 8.1 影響を受けるプラグイン: Perfmatters 影響を受けるバージョン: = 2.5.9.1 エクスプロイト python3 exploit/exploit.py http://target POC bash poc/poc.sh http://target 免責事項...

CVE-2026-9789

CVE 编号： CVE-2026-9789 研究人员： Vo Duc Thang ugvxb 致谢： https://community.acer.com/en/kb/articles/19670 视频 POC： https://drive.google.com/file/d/1B8b42bE68CWMnlqG6eJWi0txGFsHAJZc/view?usp=sharing 1. 执行摘要 在宏碁 NitroSense 软件（PSAdminAgent.exe）中发现了一个严重的本地权限提升漏洞。该漏洞允许任何经过身份验证的本地用户以 SYSTEM...

CVE-2024-27460

CVE-2024-27460 - Plantronics Desktop Hub LPE 임의 파일 삭제를 통한 SYSTEM 권한 상승. 대부분의 코드는 @filipdragovic이 작성한 참조 PoC를 기반으로 합니다. @filipdragovic & @k0zmer에게 감사드립니다 : 블로그 게시물: https://mantodeasecurity.de/en/2024/05/cve-2024-27460-plantronics-hub-lpe 참고 자료...

CVE-2024-5932

この投稿は EQSTLab が公開した研究記事です。 ❗❗ 重要 ❗❗ 現在、xmrig を実行する偽の PoC GitHub リポジトリが存在します。詳細については以下のリンクをご確認ください : URL1: https://x.com/win3zz/status/1828704644987511107 URL2: https://x.com/bornunique911/status/1828712791844524453 URL3: https://x.com/Chocapikk/status/1828801346637856841 CVE-2024-5932 ★...

CVE-2022-30206

CVE-2022-30206 이것은 CVE-2022-30206의 PoC입니다. 소개 임의 파일 삭제를 위해 다음 작업을 수행하세요: 1. addprinter.exe를 실행하여 프린터를 만들고 C:\Users\Public\tmp\1에 SpoolDirectory를 설정합니다. 2. FileLock.exe TargetFile을 실행하여 .SHD 파일을 TargetFile로 리디렉션하고 TargetFile에 oplock을 설정합니다. 3. openprinter.exe를 실행하여 프린터가 작동하게 하면 oplock이 트리거되고,...

VEN0m-Ransomware

VEN0m 랜섬웨어 https://github.com/user-attachments/assets/5a1fc9b5-a647-41f6-a152-7b9d97381adc 이 프로젝트는 합법적이고 서명된 드라이버가 무기화되어 방어 체계를 우회하고 실제 사이버 공격을 시뮬레이션하는 랜섬웨어를 배포하는 방법을 보여줍니다. 🚨 Windows 11 Pro 24H2에서 테스트 완료. 최초 릴리스 날짜2026-02-23 기준으로 완전히 탐지되지 않습니다. | 우회| UAC 우회 ---|---|--- BitDefender| ✅| ✅ Kaspersk...

CVE-2025-63945-Tencent-iOA-EoP

CVE-2025-63945 Tencent iOA EoP Version : before 210.9.28693.62001 요약: 저는 Tencent PC Manager에서 C:\Windows\Temp 아래의 파일과 디렉터리가 안전하지 않게 처리되는 취약점을 발견했습니다. 공격자는 심볼릭 링크 공격을 이용하여 SYSTEM 권한을 가진 프로세스가 임의의 파일을 삭제하도록 유도하여 로컬 권한 상승을 일으킬 수 있습니다. 구체적으로, "ioa" 구성 요소를 사용할 때 LegacyKBioawin.exe라는 프로세스가 주기적으로 실행됩니다...

duplicate-CVE-2025-4720-

cve-srms-drop-student-path-traversal CVE-2025-4720dupe SourceCodester SRMS 1.0의 임의 파일 삭제 설명 SourceCodester Student Result Management System SRMS 1.0의 dropstudent.php 엔드포인트에서 경로 탐색Path Traversal 취약점이 발견되었습니다. 애플리케이션은 img GET 매개변수로부터 사용자 제어 입력을 받아 검증 없이 바로 unlink 함수에 전달하므로, 서버 상의 임의 파일을 삭제할 수 있습니다...

CVE-2025-11988

1 공개 cryptoajax nonce 추출 UA='Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:127.0 Gecko/20100101 Firefox/127.0' PAGEURL='http://localhost/wordpress//' NONCE=$curl -s "$PAGEURL" -A "$UA" | \ perl -0777 -ne 'print "$1\n" if /cryptoconnectChainAjax\s=\s^"nonce"\s:\s"^"+"/s' Fallback extraction -z...

CVE-2026-94580

An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary file...

EUVD-2026-94683

An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary file...

CVE-2026-94580

A path traversal vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 10.0.1 , specifically within the component handling USB storage operations . An authenticated user with USB management privileges can manipulate requested target paths to bypass intende...

CVE-2026-94580

An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary file...

CVE-2024-5932

이 게시물은 EQSTLab이 발행한 연구 문서입니다. ❗❗ 중요 ❗❗ 현재 xmrig를 실행하는 가짜 PoC GitHub 저장소가 있습니다. 자세한 내용은 아래 링크를 확인하세요 : URL1: https://x.com/win3zz/status/1828704644987511107 URL2: https://x.com/bornunique911/status/1828712791844524453 URL3: https://x.com/Chocapikk/status/1828801346637856841 CVE-2024-5932 ★...

WordPress WP Fastest Cache <= 0.9.0.2 - Authenticated Arbitrary File Deletion

The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capability checking and insufficient path validation. This makes it possible for authenticated users with minimal permissions to delete...

Meta Box <= 4.16.2 - Arbitrary File Deletion

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion in the ajaxdeletefile function. The function accepts any attachmentid from the POST request and directly calls wpdeleteattachment or unlink without validating that the attachment belongs to the specified Meta Box field,...

Nevma Adaptive Images - Arbitrary File Deletion

Nevma Adaptive Images plugin before 0.6.67 for WordPress contains an arbitrary file deletion caused by unsanitized input in adaptive-images-script.php, letting remote attackers delete arbitrary files, exploit requires sending specific request parameters. id: CVE-2019-14206 info: name: Nevma...

Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion

The Avada Fusion Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybedeletefiles function. An unauthenticated attacker can delete arbitrary files on the server by manipulating the filepath parameter in the...