CVE-2022-2431

The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file type and path validation on the deleteFiles function found in the /Admin/Menu/Packages.php file that triggers upon download post deletion...

Path traversal

The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file type and path validation on the deleteFiles function found in the /Admin/Menu/Packages.php file that triggers upon download post deletion...

CVE-2022-2431 Download Manager <= 3.2.50 - Authenticated (Contributor+) Arbitrary File Deletion

The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file type and path validation on the deleteFiles function found in the /Admin/Menu/Packages.php file that triggers upon download post deletion...

CVE-2022-2431 Download Manager <= 3.2.50 - Authenticated (Contributor+) Arbitrary File Deletion

The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file type and path validation on the deleteFiles function found in the /Admin/Menu/Packages.php file that triggers upon download post deletion...

CVE-2022-2431

The CVE-2022-2431 issue affects the WordPress Download Manager plugin (versions up to 3.2.50). A validation flaw in deleteFiles() (Packages.php) allows authenticated contributors+ to supply an arbitrary file path via file[files], enabling deletion of critical files such as /wp-config.php upon pos...

PT-2022-16599 · WordPress · Download Manager

Name of the Vulnerable Software and Affected Versions: Download Manager plugin for WordPress versions up to, and including 3.2.50 Description: The issue arises from insufficient file type and path validation on the deleteFiles function found in the /Admin/Menu/Packages.php file. This function is...

Arbitrary file deletion

A local file disclosure vulnerability in /appConfig/userDB.json of Telos Alliance Omnia MPX Node through 1.0.0-1.4.9 allows attackers to access users credentials which makes him able to gain initial access to the control panel with high privilege because the cleartext storage of sensitive...

CVE-2022-36593

kkFileView v4.0.0 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter at /controller/FileController.java...

CVE-2022-36593

kkFileView v4.0.0 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter at /controller/FileController.java...

Arbitrary file deletion

kkFileView v4.0.0 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter at /controller/FileController.java...

CVE-2022-36593

CVE-2022-36593 affects kkFileView v4.0.0, exposing an arbitrary file deletion vulnerability through the fileName parameter in /controller/FileController.java. The root cause is the unsafe handling of fileName, enabling deletion of arbitrary files. Impact is stated as deletion capability; no fixes...

CVE-2022-36593

kkFileView v4.0.0 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter at /controller/FileController.java...

CVE-2022-36593

kkFileView v4.0.0 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter at /controller/FileController.java...

PT-2022-23493 · Unknown · Kkfileview

Name of the Vulnerable Software and Affected Versions: kkFileView version 4.0.0 Description: The issue allows for arbitrary file deletion via the fileName parameter at the /controller/FileController.java endpoint. Recommendations: For kkFileView version 4.0.0, consider restricting access to the...

kkFileView 路径遍历漏洞

Keking kkFileView is a Spring-Boot project for online previewing of files and documents from Keking Technology Keking. A path traversal vulnerability exists in kkFileView v4.0.0, which is caused by an arbitrary file deletion vulnerability found in the fileName parameter of...

Arbitrary file deletion

Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API...

ASB-A-221855295

In checkAccess of MediaProvider.java, there is a possible file deletion due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Ingredients Stock Management System Arbitrary File Deletion Vulnerability

Ingredients Stock Management System is an ingredient stock management system from Carlo Montero's personal developer. v1.0 of Ingredients Stock Management System is vulnerable to an arbitrary file deletion vulnerability in component /classes/ Master.php?f=deleteimg lacks validation for the delete...

CVE-2022-2638

The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high privilege users to delete arbitrary file from the server...

CVE-2022-2638

The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high privilege users to delete arbitrary file from the server...