WordPress Car Dealer theme <= 1.6.3 - Authenticated (Subscriber+) Arbitrary File Deletion and Read vulnerability

Authenticated Subscriber+ Arbitrary File Deletion and Read vulnerability discovered by Tonn in WordPress Theme Car Dealer versions = 1.6.3...

Mautic allows Remote Code Execution and File Deletion in Asset Uploads

Summary This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users. Remote Code Execution RCE via Asset Upload: A Remote Code Execution vulnerability has been identified in the asset upload...

CVE-2024-47051

This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users. Remote Code Execution RCE via Asset Upload: A Remote Code Execution vulnerability has been identified in the asset upload...

CVE-2024-47051

CVE-2024-47051 affects Mautic versions before 5.2.3. Two authenticated-user vulnerabilities exist: (1) Remote Code Execution via Asset Upload due to insufficient enforcement of allowed file extensions, enabling executable uploads; (2) Path Traversal in upload validation allowing authenticated use...

CVE-2024-47051 Remote Code Execution & File Deletion in Asset Uploads

This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users. Remote Code Execution RCE via Asset Upload: A Remote Code Execution vulnerability has been identified in the asset upload...

CVE-2024-47051 Remote Code Execution & File Deletion in Asset Uploads

This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users. Remote Code Execution RCE via Asset Upload: A Remote Code Execution vulnerability has been identified in the asset upload...

CVE-2024-47051 Remote Code Execution & File Deletion in Asset Uploads

This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users. Remote Code Execution RCE via Asset Upload: A Remote Code Execution vulnerability has been identified in the asset upload...

Dell SupportAssist OS Recovery Symbolic Link Attack (DSA-2025-051)

According to its self-reported version number, the version of Dell SupportAssist OS Recovery is affected by a symbolic link attack vulnerability. A low-privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary file deletion and Elevation of Privilege...

CVE-2025-26752 WordPress VideoWhisper Live Streaming Integration plugin <= 6.2 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-integration allows Path Traversal.This issue affects Broadcast Live Video: from n/a through = 6.2...

CVE-2025-26752 WordPress VideoWhisper Live Streaming Integration plugin <= 6.2 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-integration allows Path Traversal.This issue affects Broadcast Live Video: from n/a through = 6.2...

CVE-2025-1128

The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVFFormFieldsUpload class in all versions up...

CVE-2025-1128 Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion

The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVFFormFieldsUpload class in all versions up...

WordPress Everest Forms plugin <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion vulnerability

Unauthenticated Arbitrary File Upload, Read, and Deletion vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Everest Forms versions = 3.0.9.4...

WordPress Pie Register Premium plugin <= 3.8.3.2 - Path Traversal to Non-Arbitrary File Deletion vulnerability

Path Traversal to Non-Arbitrary File Deletion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Pie Register Premium versions = 3.8.3.2...

CVE-2024-13899

The Mambo Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0 via deserialization of untrusted input via the $data parameter in the fImportMenu function. This makes it possible for authenticated attackers, with Administrator-level access a...

WordPress Helloprint Plugin <= 2.0.7 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by LVT-tholv2k in WordPress Plugin Helloprint versions = 2.0.7...

WordPress Helloprint Plugin <= 2.0.7 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by LVT-tholv2k in WordPress Plugin Helloprint versions = 2.0.7...

WordPress plugin Mambo Importer 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

Vulnerabilities fixed in Palo Alto Networks PAN OS

Palo Alto Networks has fixed vulnerabilities in PAN-OS. The vulnerabilities include an authentication bypass that allows unauthenticated malicious actors to invoke specific PHP scripts through the management Web interface, an unauthenticated file deletion that allows malicious actors to delete...

PT-2025-7389 · WordPress · Ravpage

Name of the Vulnerable Software and Affected Versions: Ravpage plugin for WordPress versions up to, and including, 2.31 Description: The issue concerns a PHP Object Injection vulnerability via deserialization of untrusted input from the paramsv2 parameter. This allows unauthenticated attackers to...