ZZCMS Arbitrary File Deletion Vulnerability (CNVD-2018-12559)

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A security vulnerability exists in the /user/del.php file in ZZCMS version 8.3. The vulnerability can be exploited to delete arbitrary files by placing a relative path to the zzcmsmain form and sending a reque...

CVE-2018-13122

onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to delete arbitrary files via the Delete Files screen, as demonstrated by a ?i=var/www/html/&f=123.php&p=edit&p=deletefile URI...

CVE-2018-13122

CVE-2018-13122 affects OneFileCMS, specifically the vulnerable onefilecms.php up to version dated 2017-10-08. The issue permits an attacker to delete arbitrary files via the Delete File(s) screen, demonstrated by a URI pattern such as ?i=var/www/html/&f=123.php&p=edit&p=deletefile. Root cause ide...

CVE-2018-13122

onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to delete arbitrary files via the Delete Files screen, as demonstrated by a ?i=var/www/html/&f=123.php&p=edit&p=deletefile URI...

CVE-2018-9242

The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier may allow an attacker to delete files in the system via specific request parameters...

Design/Logic Flaw

The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier may allow an attacker to delete files in the system via specific request parameters...

CVE-2018-9242

The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier may allow an attacker to delete files in the system via specific request parameters...

CVE-2018-9242

The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier may allow an attacker to delete files in the system via specific request parameters...

CVE-2018-9242

CVE-2018-9242 affects Palo Alto Networks PAN-OS: the management web interface on PAN-OS 6.1.x up to 6.1.20, 7.1.x up to 7.1.16, and 8.0.x up to 8.0.9 is vulnerable. The issue arises from improper validation of certain request parameters, which can allow an attacker to delete files in the system. ...

CVE-2018-13056

An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcmsmain table and then making an img add request. This can be leveraged for database access by deleting install.lock...

CVE-2018-13056

An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcmsmain table and then making an img add request. This can be leveraged for database access by deleting install.lock...

CVE-2018-13056

The CVE-2018-13056 issue affects zzcms 8.3. A vulnerability in /user/del.php allows deleting arbitrary files by inserting a relative path into the zzcms_main table and triggering an img add request, which can be leveraged to delete install.lock and thereby enable access to the database. The conne...

Yxcms Arbitrary File Deletion Vulnerability

YXcms is a PHP and MySQL based enterprise building content management system CMS. An arbitrary file deletion vulnerability exists in protected/apps/admin/controller/photoController.php in YXcms 1.4.7. A remote attacker can exploit this vulnerability by sending the 'picname' parameter via...

Arbitrary File Deletion Vulnerability in ZZCMS Version 8.3

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. An arbitrary file deletion vulnerability exists in ZZCMS version 8.3. An attacker can exploit the vulnerability to delete arbitrary files...

ZOHO ManageEngine Desktop Central Access Control Error Vulnerability

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. An access control err...

Code injection

protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=admin/photo/delpic picname parameter...

CVE-2018-13025

protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=admin/photo/delpic picname parameter...

CVE-2018-12999

CVE-2018-12999 affects Zoho ManageEngine Desktop Central 10.0.255. The issue is an incorrect access control in AgentTrayIconServlet that lets an attacker delete files on the web server without authentication by sending a crafted request containing computerName=../ to the /agenttrayicon URI. This ...

Arbitrary file deletion

GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI...

Local Privilege Escalation in Management Web Interface

A vulnerability exists in the Management web interface that could allow local privilege escalation. The Management web interface does not properly validate specific request parameters, which can potentially allow deletion of files in the system. Ref. PAN-90954; CVE-2018-9242 Successful exploitati...