Plenti 注入漏洞

Plenti is a static site generator from Plentico open source. An injection vulnerability exists in versions of Plenti prior to 0.7.2, which stems from the fact that when a user runs their site, the /postLocal endpoint can be exploited for arbitrary file deletion, potentially resulting in loss of...

CVE-2024-48225

Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile...

CVE-2024-48225

Funadmin v5.0.2 contains an arbitrary file deletion vulnerability in the /curd/index/delfile endpoint. Multiple connected sources consistently describe this issue, noting that lack of proper access control allows unauthorized deletion of files. The vulnerability is categorized as a high-integrity...

PT-2024-33495 · Plenti +1 · Plenti +1

Name of the Vulnerable Software and Affected Versions: Plenti versions prior to 0.7.2 Description: The issue is related to an arbitrary file deletion vulnerability. The /postLocal endpoint is vulnerable to an arbitrary file write deletion when a Plenti user serves their website. This problem may...

CVE-2024-48225

Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile...

CVE-2024-45259

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted...

CVE-2024-45259

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted...

The vulnerability of the Manage Bank Statement Handler component of the SAP S/4HANA software platform allows a malicious individual to gain access to modify or delete files.

The vulnerability of the Manage Bank Statement Handler component in the SAP S/4HANA software platform is related to the absence of a mechanism to prevent unintended modifications to resources during request processing. Exploiting this vulnerability could allow an attacker to gain access to modify...

CVE-2024-45259

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted...

GL.iNet多款产品 安全漏洞

GL.iNet MT3000 and others are products of GL.iNet China.GL.iNet MT3000 is an AX3000 portable router using Wi-Fi 6 protocol.GL.iNet MT2500 is a router.GL.iNet MT6000 is a router.GL.iNet MT6000 is a router. A security vulnerability exists in several GL.iNet products. An attacker could exploit the...

CVE-2024-45259

An issue in GL.iNet devices (MT6000, MT3000, MT2500, AXT1800, AX1800) running 4.6.2 allows deletion of any file via the download interface by intercepting an HTTP request and altering the filename property. The root cause is manipulation of the filename parameter in the download flow, leading to ...

CVE-2024-49657 WordPress 3D Work In Progress plugin <= 1.0.3 - Arbitrary File Deletion vulnerability

Missing Authorization vulnerability in Renata Bracichowicz 3D Work In Progress renee-work-in-progress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D Work In Progress: from n/a through = 1.0.3...

CVE-2024-49657 WordPress 3D Work In Progress plugin <= 1.0.3 - Arbitrary File Deletion vulnerability

Missing Authorization vulnerability in Renata Bracichowicz 3D Work In Progress renee-work-in-progress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D Work In Progress: from n/a through = 1.0.3...

WordPress 3D Work In Progress plugin <= 1.0.3 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin 3D Work In Progress versions = 1.0.3...

Adobe Creative Cloud < 5.1 Arbitrary File Deletion (APSB20-11)

The version of Adobe Creative Cloud installed on the remote Windows host is prior to 5.1. It is, therefore, affected by a vulnerability as referenced in the APSB20-11 advisory. - Creative Cloud Desktop Application versions 5.0 and earlier have a time-of-check to time-of-use toctou race condition...

WordPress 3D Work In Progress Plugin <= 1.0.3 is vulnerable to Arbitrary File Deletion

Software 3D Work In Progress Type Plugin Vulnerable versions = 1.0.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Deletion CVE CVE-2024-49657 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 209728d5f5a9 Credits stealthcopter Required privilege...

CVE-2024-10079

The WP Easy Post Types plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.4 via deserialization of untrusted input from the 'text' parameter in the 'ajaximportcontent' function. This allows authenticated attackers, with subscriber-level permissions an...

CVE-2024-49315 WordPress FREE DOWNLOAD MANAGER plugin <= 1.0.0 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in CodeFlock FREE DOWNLOAD MANAGER free-download-manager allows Path Traversal.This issue affects FREE DOWNLOAD MANAGER: from n/a through = 1.0.0...

CVE-2024-49253 WordPress Analyse Uploads plugin <= 0.5 - Arbitrary File Deletion vulnerability

Relative Path Traversal vulnerability in JamesPark.ninja Analyse Uploads analyse-uploads allows Relative Path Traversal.This issue affects Analyse Uploads: from n/a through = 0.5...

CVE-2024-49253 WordPress Analyse Uploads plugin <= 0.5 - Arbitrary File Deletion vulnerability

Relative Path Traversal vulnerability in JamesPark.ninja Analyse Uploads analyse-uploads allows Relative Path Traversal.This issue affects Analyse Uploads: from n/a through = 0.5...