Design/Logic Flaw

Online Fire Reporting System v1.0 is vulnerable to Delete any file via /ofrs/classes/Master.php?f=deleteimg...

Design/Logic Flaw

elitecms v1.01 is vulnerable to Delete any file via /admin/deleteimage.php?file=...

Rescue Dispatch Management System 安全漏洞

Rescue Dispatch Management System is a rescue dispatch management system developed by Carlo Montero. v1.0 of Rescue Dispatch Management System is vulnerable to an arbitrary file deletion vulnerability in /rdms/classes/ Master.php?f=deleteimg lacks valid validation for file names, which can be...

elitecms 路径遍历漏洞

Elitecms is a web content management from elitecms India. elitecms version 1.01 has an arbitrary file deletion vulnerability that can be exploited by attackers to delete any file...

WordPress HTML2WP plugin <= 1.0.0 - Authenticated Arbitrary File Deletion vulnerability

Authenticated Arbitrary File Deletion vulnerability discovered by Daniel Ruf in WordPress HTML2WP plugin versions = 1.0.0. Solution Deactivate and delete. This plugin has been closed as of May 4, 2022 and is not available for download. This closure is temporary, pending a full review...

Online Fire Reporting System 安全漏洞

Online Fire Reporting System is an online fire reporting system from Carlo Montero's personal developer. v1.0 of Online Fire Reporting System is vulnerable to an arbitrary file deletion vulnerability, which originates in /ofrs/classes/Master.php?f= deleteimg lacks valid validation for filenames,...

HTML2WP <= 1.0.0 - Subscriber+ Arbitrary File Deletion

The plugin does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file To delete the license.txt at the root of the blog: await...

Online Car Wash Booking System 安全漏洞

Online Car Wash Booking System is an online car wash booking system by Carlo Montero. v1.0 of Online Car Wash Booking System is vulnerable to an arbitrary file deletion vulnerability in /ocwbs/classes/Master.php? f=deleteimg page lacks validation for file names, which can be exploited to cause...

HTML2WP <= 1.0.0 - Subscriber+ Arbitrary File Deletion

The plugin does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file PoC To delete the license.txt at the root of the blog: await...

CVE-2022-31973

Online Fire Reporting System v1.0 is vulnerable to Delete any file via /ofrs/classes/Master.php?f=deleteimg...

CVE-2022-31973

CVE-2022-31973 affects the Online Fire Reporting System v1.0. The vulnerability arises in the file path /ofrs/classes/Master.php?f=delete_img, where filenames are not properly validated, enabling arbitrary file deletion. This is described consistently across multiple sources in the connected docu...

CVE-2022-31945

Rescue Dispatch Management System v1.0 is vulnerable to Delete any file via /rdms/classes/Master.php?f=deleteimg...

CVE-2022-31945

CVE-2022-31945 affects Rescue Dispatch Management System v1.0. The vulnerability enables arbitrary file deletion via /rdms/classes/Master.php?f=delete_img due to missing validation for file names in the delete_img path. Impact is described as arbitrary file deletion with high integrity and availa...

CVE-2022-31342

Online Car Wash Booking System v1.0 is vulnerable to Delete any file via /ocwbs/classes/Master.php?f=deleteimg...

OS Command Injection in file editor

Description Deploy and run gogs. Proof of Concept 1. Create a repository and upload a file named config to the repository repo6. The content of the file is as follows: xml core repositoryformatversion = 0 filemode = true bare = false logallrefupdates = true ignorecase = true precomposeunicode =...

CVE-2022-30804

The vulnerability CVE-2022-30804 affects elitecms v1.01, with a concrete flaw allowing arbitrary file deletion via the API endpoint /admin/delete_image.php?file= (and variant naming in sources as /admin/delete image.php?file=). This is supported by the PT-2022-20323 advisory, which specifies the ...

PT-2022-20323 · Elitecms · Elitecms

Name of the Vulnerable Software and Affected Versions: elitecms version 1.01 Description: The issue allows deletion of any file via the "/admin/delete image.php?file=" API endpoint. The estimated number of potentially affected devices worldwide is not specified. There is no information about...

CVE-2022-30687

Trend Micro Maximum Security 2022 is vulnerable to a link following vulnerability that could allow a low privileged local user to manipulate the product's secure erase feature to delete arbitrary files...

CVE-2022-26773

A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.12.4 for Windows. An application may be able to delete files for which it does not have permission...

CVE-2022-26773

A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.12.4 for Windows. An application may be able to delete files for which it does not have permission...