342 matches found
CVE-2025-4564 TicketBAI Facturas para WooCommerce <= 3.18 - Unauthenticated Arbitrary File Deletion
The TicketBAI Facturas para WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation via the 'delpdf' action in all versions up to, and including, 3.18. This makes it possible for unauthenticated attackers to delete arbitrary files on the...
CVE-2025-4206
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'processexportdelete' and 'processimportdelete' functions in all versions up to, and including,...
CVE-2025-45238
foxcms v1.2.5 was discovered to contain an arbitrary file deletion vulnerability via the delRestoreSerie method...
CVE-2025-45238
FoxCMS v1.2.5 is affected by an arbitrary file deletion vulnerability via the delRestoreSerie method. The issue stems from the delRestoreSerie functionality and can lead to deletion of arbitrary files, as described across multiple sources (including Red Hat and PT Security advisories). The vulner...
CVE-2025-45242
Summary: CVE-2025-45242 affects Rhymix v2.1.22 with an arbitrary file deletion vulnerability in the procFileAdminEditImage workflow under /file/file.admin.controller.php. The issue originates from improper handling in that method, enabling deletion of arbitrary files. Documented impact is a high-...
CVE-2025-31411
CVE-2025-31411 affects Linet ERP-Woocommerce Integration (WordPress plugin)
CVE-2025-29150
BlueCMS 1.6 suffers from Arbitrary File Deletion via the id parameter in an /publish.php?act=del request...
PT-2025-14541 · Os4Ed · Os4Ed Opensis
Name of the Vulnerable Software and Affected Versions: OS4ED openSIS versions 8.0 through 9.1 Description: An issue in OS4ED openSIS allows attackers to execute a directory traversal and delete files by sending a crafted POST request. The attack targets the...
CVE-2024-13922
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the adminlogpage function in all versions up to, and including, 2.6.0. This makes it possible for authenticated attackers, with...
CVE-2024-7043
CVE-2024-7043 concerns open-webui/open-webui v0.3.8, where improper access control enables an attacker to enumerate and delete user-uploaded files via the API. The vulnerability arises because the system does not verify administrator privileges for GET /api/v1/files/ (listing files) and then enab...
CVE-2024-6851 Arbitrary File Deletion in aimhubio/aim
In version 3.22.0 of aimhubio/aim, the LocalFileManager.cleanup function in the aim tracking server accepts a user-specified glob-pattern for deleting files. The function does not verify that the matched files are within the directory managed by LocalFileManager, allowing a maliciously crafted...
CVE-2025-0452
CVE-2025-0452 affects eosphoros-ai/DB-GPT (latest) and is described as vulnerable to arbitrary file deletion on Windows via the /v1/agent/hub/update endpoint. The root cause cited across sources is failure to properly filter the backslash character, a common Windows path separator, allowing manip...
PT-2025-12179
Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8 Description The issue allows attackers to view and delete any files due to improper access control. The application fails to verify whether the attacker is an administrator, enabling them to directly call th...
CVE-2025-25266
A vulnerability has been identified in Tecnomatix Plant Simulation V2302 All versions V2302.0021, Tecnomatix Plant Simulation V2404 All versions V2404.0010. The affected application does not properly restrict access to the file deletion functionality. This could allow an unauthorized attacker to...
CVE-2025-25266
A vulnerability has been identified in Tecnomatix Plant Simulation V2302 All versions V2302.0021, Tecnomatix Plant Simulation V2404 All versions V2404.0010. The affected application does not properly restrict access to the file deletion functionality. This could allow an unauthorized attacker to...
CVE-2025-25266
A vulnerability has been identified in Tecnomatix Plant Simulation V2302 All versions V2302.0021, Tecnomatix Plant Simulation V2404 All versions V2404.0010. The affected application does not properly restrict access to the file deletion functionality. This could allow an unauthorized attacker to...
CVE-2025-25266
A vulnerability has been identified in Tecnomatix Plant Simulation V2302 All versions V2302.0021, Tecnomatix Plant Simulation V2404 All versions V2404.0010. The affected application does not properly restrict access to the file deletion functionality. This could allow an unauthorized attacker to...
Siemens Tecnomatix Plant Simulation 安全漏洞
Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens Germany. The power of discrete event simulation is used to analyze and optimize throughput and thereby improve manufacturing system performance. A security vulnerability exists in Siemens Tecnomatix Plant Simulation...
CVE-2024-12035
The CS Framework plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cswidgetfiledelete function in all versions up to, and including, 6.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to dele...