CVE-2025-68912 WordPress HDForms plugin <= 1.6.1 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Harmonic Design HDForms hdforms allows Path Traversal.This issue affects HDForms: from n/a through = 1.6.1...

CVE-2025-68912

HDForms (WordPress plugin) vulnerable through HDForms hdforms 1.6.1. Patch guidance from PT-2026-4114 corroborates updating to a version later than 1.6.1.

CVE-2025-68912 WordPress HDForms plugin <= 1.6.1 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Harmonic Design HDForms hdforms allows Path Traversal.This issue affects HDForms: from n/a through = 1.6.1...

CVE-2025-68907

CVE-2025-68907 affects AivahThemes Hostme v2 (hostmev2) up to and including version 7.0, with an path traversal-related vulnerability enabling arbitrary file deletion. Public sources (NVD/Red Hat/patchstack/CVE lists) corroborate Arbitrary File Deletion via Path Traversal in Hostme v2. The PatchS...

CVE-2025-68907 WordPress Hostme v2 theme <= 7.0 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in AivahThemes Hostme v2 hostmev2 allows Path Traversal.This issue affects Hostme v2: from n/a through = 7.0...

CVE-2025-68901 WordPress Anona theme <= 8.0 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in AivahThemes Anona anona allows Path Traversal.This issue affects Anona: from n/a through = 8.0...

CVE-2025-68901

CVE-2025-68901 affects AivahThemes Anona (WordPress Theme) up to version 8.0. Root cause is path traversal due to improper limitation of a pathname to a restricted directory, enabling unauthorized file access and potentially arbitrary file operations. Connected sources corroborate a related Arbit...

CVE-2025-68901 WordPress Anona theme <= 8.0 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in AivahThemes Anona anona allows Path Traversal.This issue affects Anona: from n/a through = 8.0...

CVE-2025-67963 WordPress Movie Booking plugin <= 1.1.5 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ovatheme Movie Booking movie-booking allows Path Traversal.This issue affects Movie Booking: from n/a through = 1.1.5...

CVE-2025-67963

CVE-2025-67963 refers to the WordPress plugin Movie Booking (ovatheme Movie Booking) , affected up to version 1.1.5 . The incident is described as an unauthenticated, high-severity path traversal/arbitrary file deletion vulnerability that could enable deletion of arbitrary files on affected sites...

WordPress Movie Booking plugin <= 1.1.5 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Movie Booking versions = 1.1.5...

GHSA-J7XP-4MG9-X28R Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion

Summary knowledgeBase.removeFilesFromKnowledgeBase tRPC ep allows authenticated users to delete files from any knowledge base without verifying ownership. Details userId filter in the database query is commented out, so it's enabling attackers to delete other users' KB files if they know the...

Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion

Summary knowledgeBase.removeFilesFromKnowledgeBase tRPC ep allows authenticated users to delete files from any knowledge base without verifying ownership. Details userId filter in the database query is commented out, so it's enabling attackers to delete other users' KB files if they know the...

WordPress e-xact-hosted-payment plugin <= 2.0 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin E-xact Hosted Payment versions = 2.0...

CVE-2026-23522

CVE-2026-23522 affects LobeChat. Prior to version 2.0.0-next.193, the tRPC endpoint knowledgeBase.removeFilesFromKnowledgeBase lacks ownership verification because the userId filter in the DB query is commented out, enabling an authenticated user to delete files from other users’ knowledge bases ...

CVE-2026-23522 Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion

LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, knowledgeBase.removeFilesFromKnowledgeBase tRPC ep allows authenticated users to delete files from any knowledge base without verifying ownership. userId filter in the database query is commented out, so it's...

CVE-2026-23522 Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion

LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, knowledgeBase.removeFilesFromKnowledgeBase tRPC ep allows authenticated users to delete files from any knowledge base without verifying ownership. userId filter in the database query is commented out, so it's...

Lobe Chat security vulnerability

Lobe Chat is an open-source, high-performance chatbot framework developed by LobeHub. Versions of Lobe Chat prior to 2.0.0-next.193 contained security vulnerabilities, which were caused by a lack of ownership verification. This vulnerability could lead to arbitrary file deletion...

News Portal Project: Vulnerability Exposing Deleted Files

News Portal Project is a news portal project developed by PHPGurukul. The News Portal Project has a vulnerability regarding arbitrary file deletion. This vulnerability stems from improper handling of the 'file' parameter in the removefile.php file. Attackers can exploit this vulnerability to caus...

CVE-2025-14233

Invalid free in CPCA file deletion processing on Small Office Multifunction Printers and Laser Printers which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. : Satera LBP670C Series/Satera MF750C Series firmware v06.02...