342 matches found
CVE-2025-3055 WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Deletion
The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteavatarajax function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above,...
CVE-2025-20259
Cisco ThousandEyes Endpoint Agent for Windows is affected by vulnerabilities in the update process that allow an authenticated, local attacker to delete arbitrary files via a symbolic-link upgrade path. Root cause: improper access controls on local filesystem during the agent upgrade, enabling th...
CVE-2025-37094
A directory traversal arbitrary file deletion vulnerability exists in HPE StoreOnce Software...
CVE-2025-48480
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an authorized user with the administrator role or with the privilege User::PERMEDITUSERS can create a user, specifying the path to the user's avatar ../.htaccess during creation, and then delete the user's...
CVE-2025-4603
The vulnerability CVE-2025-4603 affects the WordPress plugin eMagicOne Store Manager for WooCommerce (versions
CVE-2024-40455
An arbitrary file deletion vulnerability in ThinkSAAS v3.7 allows attackers to delete arbitrary files via a crafted request...
CVE-2024-48225
Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile...
CVE-2023-45618
There are arbitrary file deletion vulnerabilities in the AirWave client service accessed by PAPI Aruba's access point management protocol. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files on the underlying operating system, which could lead to the...
CVE-2023-33604
Imperial CMS v7.5 was discovered to contain an arbitrary file deletion vulnerability via the DelspReFile function in /sp/ListSp.php. This vulnerability is exploited by attackers via a crafted POST request...
CVE-2023-28868
Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to delete arbitrary files on the operating system by creating a symbolic link...
CVE-2023-27700
MuYuCMS v2.2 was discovered to contain an arbitrary file deletion vulnerability via the component /accessory/picdel.html...
CVE-2023-27469
Malwarebytes Anti-Exploit 4.4.0.220 is vulnerable to arbitrary file deletion and denial of service via an ALPC message in which FullFileNamePath lacks a '\0' character...
CVE-2023-50731
MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the put method in mindsdb/mindsdb/api/http/namespaces/file.py does not validate the user-controlled name value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which...
CVE-2023-20098
A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files. This vulnerability is due to improper filtering of directory traversal character sequences within system commands. An attacker with administrative privileges could...
CVE-2022-47926
AyaCMS 3.1.2 is vulnerable to file deletion via /aya/module/admin/fstdel.inc.php...
CVE-2022-2638
The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high privilege users to delete arbitrary file from the server...
CVE-2022-36171
MapGIS IGServer 10.5.6.11 is vulnerable to Arbitrary file deletion...
CVE-2022-32328
Fast Food Ordering System v1.0 is vulnerable to Delete any file. via /ffos/classes/Master.php?f=deleteimg...