QiHang Media Web (QH.aspx) Digital Signage 3.0.9 Unauthenticated Arbitrary File Deletion

Summary Digital Signage Software. Description Input passed to the 'data' parameter in 'QH.aspx' for delete action is not properly sanitised before being used to delete files. This can be exploited by an unauthenticated attacker to delete files with the permissions of the web server using their...

Quiz and Survey Master < 7.0.1 - Unauthenticated Arbitrary File Deletion

This flaw allows users to delete arbitrary files like a site’s wp-config.php file which could effectively take a site offline and allow an attacker to take over the vulnerable site. history.pushState'', '', '/'...

QiHang Media Web Digital Signage 3.0.9 Arbitrary File Deletion

QiHang Media Web QH.aspx Digital Signage 3.0.9 Unauthenticated Arbitrary File Deletion Vendor: Shenzhen Xingmeng Qihang Media Co., Ltd. Guangzhou Hefeng Automation Technology Co., Ltd. Product web page: http://www.howfor.com Affected version: 3.0.9.0 Summary: Digital Signage Software. Desc: Input...

File Deletion Vulnerability in EmpireCMS of Dixing Software Development Co.

EmpireCMS is a content management system CMS. EmpireCMS has a file deletion vulnerability that can be exploited by an attacker to delete arbitrary files...

TPshop open source mall management backend System page there are arbitrary file deletion vulnerability

TPshop open source mall is developed with the latest version of ThinkPHP shop mall. TPshop open source mall management backend System page there are arbitrary file vulnerability, an attacker can exploit the vulnerability to delete arbitrary files...

Arbitrary File Deletion Vulnerability in CLTPHP Open Source Edition

CLTPHP content management system is an efficient site-building PHP content management system , but also an open source CMS system . CLTPHP open source version of the arbitrary file deletion vulnerability, an attacker can exploit the vulnerability on the integrity of the system...

File Deletion Vulnerability in CLTPHP Open Source Edition

CLTPHP is a content management system based on ThinkPHP5 development with Layui framework in the backend. CLTPHP open source version exists file deletion vulnerability. An attacker can exploit the vulnerability to delete arbitrary files , resulting in a program crash...

Vulnerability Spotlight: Two vulnerabilities in SoftPerfect RAM Disk

A Cisco Talos researcher discovered this vulnerability. Blog by Jon Munshaw. Cisco Talos researchers recently discovered that a specific driver in the SoftPerfect RAM disk could allow an adversary to delete files on an arbitrary basis and disclose sensitive information. SoftPerfect RAM Disk is a...

CVE-2020-15135

The CVE-2020-15135 entry concerns the save-server npm package, where versions before 1.05 are vulnerable to CSRF due to no CSRF mitigation. The issue enables a attacker, via a malicious site, to perform actions like uploading/deleting files, adding redirects, and potentially managing users if the...

CVE-2020-13522

An exploitable arbitrary file delete vulnerability exists in SoftPerfect RAM Disk 4.1 spvve.sys driver. A specially crafted I/O request packet IRP can allow an unprivileged user to delete any file on the filesystem. An attacker can send a malicious IRP to trigger this vulnerability...

Newsletter WordPress Plugin Opens Door to Site Takeover

Newsletter, a WordPress plugin with more than 300,000 installations, has a pair of vulnerabilities that could lead to code-execution and even site takeover. The Newsletter plugin offers site admins a visual editor that can be used to create newsletters and email campaigns from within WordPress...

SoftPerfect RAM Disk spvve.sys 0x222004 arbitrary file deletion vulnerability

Talos Vulnerability Report TALOS-2020-1121 SoftPerfect RAM Disk spvve.sys 0x222004 arbitrary file deletion vulnerability August 4, 2020 CVE Number CVE-2020-13522 SUMMARY An exploitable arbitrary file delete vulnerability exists in SoftPerfect RAM Disk 4.1 spvve.sys driver. A specially crafted I/O...

Arbitrary file deletion vulnerability in the background of Beijing Kangsheng Xinchuang Technology Co.

Discuz! is a general community forum software system launched by Beijing Kangsheng Xinchuang Technology Co. Discuz! x3.4 backend has an arbitrary file deletion vulnerability that can be exploited by an attacker to construct a packet to delete arbitrary files, possibly enabling reinstallation...

October CMS Build 465 XSS / File Read / File Deletion / CSV Injection Vulnerabilities

October CMS builds 465 and below suffer from arbitrary file read, arbitrary file deletion, file uploading to arbitrary locations, persistent and reflective cross site scripting, and CSV injection vulnerabilities. October CMS = Build 465 Multiple Vulnerabilities Author - Sivanesh Ashok |...

October CMS Build 465 XSS / File Read / File Deletion / CSV Injection

October CMS = Build 465 Multiple Vulnerabilities Author - Sivanesh Ashok | @sivaneshashok | stazot.com Date : 2020-03-31 Vendor : https://octobercms.com/ Version : = Build 465 Tested on : Build 465 CVE : CVE-2020-5295, CVE-2020-5296, CVE-2020-5297, CVE-2020-5298, CVE-2020-5299, CVE-2020-11083 Las...

Arbitrary File Deletion Vulnerability in Bludit CMS v3.13.0

Bludit CMS is a foreign multilingual lightweight website CMS system. Bludit CMS v3.13.0 has an arbitrary file deletion vulnerability that allows attackers to delete arbitrary zip files...

Cisco Adaptive Security Appliance Software 9.7 - Unauthenticated Arbitrary File Deletion Exploit

Exploit for hardware platform in category web applications Exploit Title: Cisco Adaptive Security Appliance Software 9.7 - Unauthenticated Arbitrary File Deletion Google Dork: inurl:/+CSCOE+/ Exploit Author: 0xmmnbassel Vendor Homepage:...

Hainan EJU Technology Co., Ltd. ejucms v2.6.0 has arbitrary file deletion vulnerability

EJU real estate system ejucms is a set of localized O2O real estate website platform system. Ltd. eju real estate system ejucms v2.6.0 arbitrary file deletion vulnerability, an attacker can exploit the vulnerability on the integrity of the system...

Arbitrary File Deletion Vulnerability in Cloud Content Management System

Yunye CMS is an enterprise website building system developed by Luoyang Yunye Information Technology Co. Cloud industry content management system there are arbitrary file deletion vulnerability, an attacker can use the vulnerability to delete arbitrary files...

Cisco Adaptive Security Appliance Software 9.7 - Unauthenticated Arbitrary File Deletion

Exploit Title: Cisco Adaptive Security Appliance Software 9.7 - Unauthenticated Arbitrary File Deletion Google Dork: inurl:/+CSCOE+/ Date: 2020-08-27 Exploit Author: 0xmmnbassel Vendor Homepage: https://www.cisco.com/c/en/us/products/security/asa-firepower-services/index.htmlmodels Version: Cisco...