PT-2025-39517

Name of the Vulnerable Software and Affected Versions Backuply – Backup, Restore, Migrate and Clone plugin for WordPress versions through 1.4.8 Description The Backuply plugin for WordPress is susceptible to arbitrary file deletion because of inadequate file path validation within the delete back...

WordPress BM Content Builder Plugin < 3.16.3.3 - Arbitrary File Deletion Vulnerability

Arbitrary File Deletion Vulnerability discovered by Bonds Patchstack Alliance in WordPress Plugin BM Content Builder versions 3.16.3.3...

CVE-2025-55910

CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in databaseadmin.php...

CVE-2025-6237

A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /api/v1/images/download/bulkdownloaditemname endpoint. By manipulating the filename arguments, attackers can read and delete any files on the server, including...

CVE-2025-55910

CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in databaseadmin.php...

CVE-2025-55910

CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in databaseadmin.php...

CVE-2025-10058

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadfunction function in all versions up to, and including, 7.27. This makes it possible for authenticated attackers, with...

CVE-2025-55910

CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in databaseadmin.php...

CmsEasy 安全漏洞

CmsEasy is a content management system CMS for creating responsive websites from China-based CmsEasy. A security vulnerability exists in CmsEasy 7.7.8.0 and earlier versions, which stems from an arbitrary file deletion issue in databaseadmin.php...

CVE-2025-55910

CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in databaseadmin.php...

CVE-2025-55910

CMSEasy is affected by CVE-2025-55910: versions 7.7.8.0 and earlier are vulnerable to arbitrary file deletion via database_admin.php. The root cause is an issue in CMSEasy’s database_admin.php handling that allows deletion of arbitrary files. Reported references across multiple sources confirm th...

PT-2025-38574

Name of the Vulnerable Software and Affected Versions CMSEasy versions prior to 7.7.8.0 Description CMSEasy versions prior to 7.7.8.0 are susceptible to arbitrary file deletion through the database admin.php file. Recommendations Update to a version newer than 7.7.8.0...

CVE-2025-10207 Authenticated File Disclosure/Delete

Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5...

CVE-2025-10207 Authenticated File Disclosure/Delete

Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5...

GHSA-VV9C-XXG7-WMV7 InvokeAI has External Control of File Name or Path

Path Traversal Vulnerability in InvokeAI A path traversal vulnerability in InvokeAI versions 6.7.0 allows an unauthenticated remote attacker to read files outside the intended media directory via the bulk downloads API. The endpoint accepts a user-controlled file/item name and concatenates it int...

InvokeAI has External Control of File Name or Path

Path Traversal Vulnerability in InvokeAI A path traversal vulnerability in InvokeAI versions 6.7.0 allows an unauthenticated remote attacker to read files outside the intended media directory via the bulk downloads API. The endpoint accepts a user-controlled file/item name and concatenates it int...

CVE-2025-6237

A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /api/v1/images/download/bulkdownloaditemname endpoint. By manipulating the filename arguments, attackers can read and delete any files on the server, including...

CVE-2025-6237

InvokeAI (versions

CVE-2025-6237 Path Traversal and Arbitrary File Deletion in invoke-ai/invokeai

A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /api/v1/images/download/bulkdownloaditemname endpoint. By manipulating the filename arguments, attackers can read and delete any files on the server, including...

CVE-2025-6237 Path Traversal and Arbitrary File Deletion in invoke-ai/invokeai

A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /api/v1/images/download/bulkdownloaditemname endpoint. By manipulating the filename arguments, attackers can read and delete any files on the server, including...