CVE-2024-11613

The CVE CVE-2024-11613 affects the WordPress File Upload plugin for WordPress, with vulnerable versions up to and including 4.24.15. The flaw arises from insufficient sanitization of the source parameter in wfu_file_downloader.php, allowing an unauthenticated attacker to specify a user-controlled...

CVE-2024-11613 WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion

The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to, and including, 4.24.15 via the 'wfufiledownloader.php' file. This is due to lack of proper sanitization of the 'source' parameter and...

PT-2025-1074

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Expedition affected versions not specified Description The issue is related to an arbitrary file deletion vulnerability in Palo Alto Networks Expedition. This vulnerability allows an unauthenticated attacker to delete...

WordPress WordPress File Upload plugin <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion vulnerability

Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion vulnerability discovered by abrahack in WordPress Plugin WordPress File Upload versions = 4.24.15...

CVE-2025-21622

ClipBucket V5 provides open source video hosting with PHP. During the user avatar upload workflow, a user can choose to upload and change their avatar at any time. During deletion, ClipBucket checks for the avatarurl as a filepath within the avatars subdirectory. If the URL path exists within the...

GO-2025-3362 SiYuan has an arbitrary file deletion vulnerability in github.com/siyuan-note/siyuan/kernel

SiYuan has an arbitrary file deletion vulnerability in github.com/siyuan-note/siyuan/kernel...

CVE-2025-21622 ClipBucket V5 Avatar URL Path Traversal to Arbitrary File Delete

ClipBucket V5 provides open source video hosting with PHP. During the user avatar upload workflow, a user can choose to upload and change their avatar at any time. During deletion, ClipBucket checks for the avatarurl as a filepath within the avatars subdirectory. If the URL path exists within the...

CVE-2025-21622

CVE-2025-21622 affects ClipBucket V5. The issue arises in the avatar deletion workflow where avatar_url is treated as a file path within the avatars directory without validating path traversal sequences. The final $file variable can be tainted by traversal inputs stored in the DB, enabling deleti...

CVE-2025-21622 ClipBucket V5 Avatar URL Path Traversal to Arbitrary File Delete

ClipBucket V5 provides open source video hosting with PHP. During the user avatar upload workflow, a user can choose to upload and change their avatar at any time. During deletion, ClipBucket checks for the avatarurl as a filepath within the avatars subdirectory. If the URL path exists within the...

CVE-2025-21622 ClipBucket V5 Avatar URL Path Traversal to Arbitrary File Delete

ClipBucket V5 provides open source video hosting with PHP. During the user avatar upload workflow, a user can choose to upload and change their avatar at any time. During deletion, ClipBucket checks for the avatarurl as a filepath within the avatars subdirectory. If the URL path exists within the...

CVE-2024-49249

CVE-2024-49249 affects the WordPress SMSA Shipping plugin (versions

CVE-2024-49249 WordPress SMSA Shipping plugin <= 2.3 - Arbitrary File Deletion vulnerability

Path Traversal: '.../...//' vulnerability in SMSA Express SMSA Shipping smsa-shipping-official allows Path Traversal.This issue affects SMSA Shipping: from n/a through = 2.3...

CVE-2024-49249 WordPress SMSA Shipping plugin <= 2.3 - Arbitrary File Deletion vulnerability

Path Traversal vulnerability in SMSA Express SMSA Shipping allows Path Traversal.This issue affects SMSA Shipping: from n/a through 2.3...

CVE-2024-12313

CVE-2024-12313 : The Compare Products for WooCommerce plugin for WordPress is vulnerable to unauthenticated PHP Object Injection in all versions up to 3.2.1 via deserialization of untrusted input from the woo_compare_list cookie. The vulnerability allows an attacker to inject a PHP Object. The de...

CVE-2024-11465 Custom Product Tabs for WooCommerce <= 1.8.5 - Authenticated (Shop Manager+) PHP Object Injection

The Custom Product Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input in the 'yikeswooproductstabs' post meta parameter. This makes it possible for authenticated attackers, with Shop...

PT-2025-1667

Name of the Vulnerable Software and Affected Versions WordPress File Upload plugin versions up to, and including, 4.24.15 Description The WordPress File Upload plugin is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion due to the lack of proper sanitization of...

WordPress SMSA Shipping plugin <= 2.3 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin SMSA Shipping versions = 2.3...

CVE-2024-46622

An Escalation of Privilege security vulnerability was found in SecureAge Security Suite software 7.0.x before 7.0.38, 7.1.x before 7.1.11, 8.0.x before 8.0.18, and 8.1.x before 8.1.18 that allows arbitrary file creation, modification and deletion...

CVE-2025-21609

SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the POST /api/history/getDocHistoryContent endpoint. An attacker can craft a payload to exploit this vulnerability,...

CVE-2025-21609 SiYuan has an arbitrary file deletion vulnerability

SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the POST /api/history/getDocHistoryContent endpoint. An attacker can craft a payload to exploit this vulnerability,...