CVE-2019-14529

CVE-2019-14529 Vulnerabilidad de inyección SQL múltiple en el proyecto OpenEMR Función vulnerable en el archivo: /openemr/interface/forms/eyemag/save.php Condiciones : cualquier usuario autorizado Versiones vulnerables: 5.0.2, corregido en la versión 5.0.2. Descripción Hay dos funciones: 1...

CVE-2024-21111

CVE-2024-21111 Oracle VirtualBox Prior to 7.0.16 is vulnerable to Local Privilege Escalation via Symbolic Link Following leading to Arbitrary File Delete and Arbitrary File Move. VirtualBox attempts to move log files as NT AUTHORITY\SYSTEM in C:\ProgramData\VirtualBox which all users can write to...

CVE-2026-14762-PoC-Exploit

CVE-2026-14762 – Code‑Projects Hotel & Tourism Reservation 1.0 SQL Injection Exploit -orange -red Fully featured, multi‑threaded, time‑based blind SQL injection exploit for CVE‑2026‑14762. Targets the /admin/rooms.php endpoint of the Code‑Projects Hotel & Tourism Reservation application version...

CVE-2024-2432-PaloAlto-GlobalProtect-EoP

CVE-2024-2432 Palo Alto GlobalProtect EoP On Windows system, it was found that GlobalProtect App version 6.1.1-5 and 6.2.0-89 was vulnerable to arbitrary file delete with elevated privileges by symbolic link attack lead to local privilege escalation on local machine. It was observed that when a...

firehol

FireHOL http://firehol.org/ root@kitploit: FireHOL, an iptables stateful packet filtering firewall for humans! FireQOS, a TC based bandwidth shaper for humans! Git These instructions are for people who are working with the git repository. There are more general instructions starting with Upgrade...

CVE-2020-14883

http://myq-x.remore:8090/index.php?m=WebServiceMgmt::invoke&p="d":"\\m\":"Wsf\\\\Win\\\\Firewall::delete\","\\p\":"----\\\"|ipconfig+/allC:\\\\Windows\\\\system32\\\\spool\\\\drivers\\\\1.txt||----","\\id\":"1","\\pwd\":"","s":"b75c29ef4a5a3d600d96732b3c5cbed1"...

Meta Box <= 4.16.2 - Arbitrary File Deletion

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion in the ajaxdeletefile function. The function accepts any attachmentid from the POST request and directly calls wpdeleteattachment or unlink without validating that the attachment belongs to the specified Meta Box field,...

OpenAPI Generator <= 7.5.0 - Arbitrary File Read/Delete

OpenAPI Generator versions 7.5.0 and below are prone to an Arbitrary File Read/Delete vulnerability. Attackers can exploit this vulnerability to read and delete files and folders from an arbitrary, writable directory. id: CVE-2024-35219 info: name: OpenAPI Generator = 7.5.0 - Arbitrary File...

CVE-2025-21420_POC

Diffing cleanmgr.exe The new version of cleanmgr.exe includes a call to the SetProcessMitigationPolicy function. With MitigationPolicy set to 16, corresponding to ProcessRedirectionTrustPolicy. Combined with Microsoft's description of CWE-59: Improper Link Resolution Before File Access 'Link...

s3sec

s3sec Prueba los buckets de AWS S3 para acceso de lectura/escritura/eliminación Esta herramienta fue desarrollada para probar rápidamente una lista de buckets de S3 para acceso público de lectura, escritura y eliminación con fines de pruebas de penetración en programas de bug bounty. Screenshot...

s3sec

s3sec Test AWS S3 buckets for read/write/delete access This tool was developed to quickly test a list of s3 buckets for public read, write and delete access for the purposes of penetration testing on bug bounty programs. Screenshot Found a bug bounty using this tool? Feel free to add me as a...

SysmonEoP

SysmonEoP Proof of Concept for arbitrary file delete/write in Sysmon CVE-2022-41120/CVE-2022-44704 Vulnerability Vulnerability is in code responsible for ClipboardChange event that can be reached through RPC. Local users can send data to RPC server which will then be written in C:\Sysmon director...

CVE-2024-51747

CVE-2024-51747 Log in with an administrator account and download the database in the system settings Modify projecthasfiles in the sqlite.db database Compress the modified sqlite.db with gzip and upload it. After uploading it to the project and clicking the file to view/download, the attacker can...

CVE-2026-57830

Helix Ultimate Framework — Unauthenticated Path-Traversal Arbitrary File/Folder Read+Delete This is a confirmed DoS + cross-tenant filesystem access vulnerability, NOT RCE. An RCE-escalation theory delete configuration.php to re-expose the Joomla installer was tested live and disproved — see "RCE...

CVE-2026-76962 Missing Authorization check in SAP S/4HANA (Manage Bank Chains app)

SAP S/4HANA Manage Bank Chains app does not perform sufficient authorization checks within certain affected functionality. An attacker with low privileges could send specially crafted requests to delete specific entries that should not be accessible to them. This results in a low impact on...

chromecookiestealer

Chrome Cookie Stealer and injector Attaches to Chrome using its Remote DevTools protocol and steals/injects/clears/deletes cookies. Heavily inspired by WhiteChocolateMacademiaNut. Cookies are dumped as JSON objects using Chrome's own format. The same format is used for cookies to be loaded. For...

CVE-2026-75855

Title Path Traversal in "create database" / "drop database" server commands allows arbitrary file write and delete outside the configured database directory Summary The POST /api/v1/server endpoint's create database and drop database commands use the caller-supplied database name to build a...

CVE-2026-86293

A flaw has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this vulnerability is an unknown functionality of the file delete-user.php of the component Deletion Endpoint. Executing a manipulation of the argument ID can lead to missing authentication. The attack may be...

CVE-2026-86293

A missing authentication flaw exists in the Deletion Endpoint (file delete-user.php) of SourceCodester Simple Traffic Offense System 1.0 . By manipulating the ID argument remotely without authentication, an attacker can perform unauthorized deletion operations, resulting in low integrity and low ...

EUVD-2026-72324

A flaw has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this vulnerability is an unknown functionality of the file delete-user.php of the component Deletion Endpoint. Executing a manipulation of the argument ID can lead to missing authentication. The attack may be...