CVE-2024-12544

Summary (supported by provided docs): CVE-2024-12544 affects the SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress. The vulnerability arises from a missing capability check in the SurveyJS_DeleteFile callback, enabling an authenticated user with Subscriber-level access or higher t...

Palo Alto Networks Patches Authentication Bypass Exploit in PAN-OS Software

Palo Alto Networks has addressed a high-severity security flaw in its PAN-OS software that could result in an authentication bypass. The vulnerability, tracked as CVE-2025-0108 , carries a CVSS score of 7.8 out of 10.0. The score, however, drops to 5.1 if access to the management interface is...

CVE-2025-0109

CVE-2025-0109 describes an unauthenticated file-deletion vulnerability in the PAN-OS management web interface. An unauthenticated attacker with network access can delete certain files as the “nobody” user, including limited logs and configuration files, but not system files. The issue is confined...

Palo Alto Networks PAN-OS 10.1.x < 10.1.14-h9 / 10.2.x < 10.2.7-h24 / 11.1.x < 11.1.6-h1 / 11.2.x < 11.2.4-h4 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 10.1.x prior to 10.1.14-h9 or 10.2.x prior to 10.2.7-h24 or 11.1.x prior to 11.1.6-h1 or 11.2.x prior to 11.2.4-h4. It is, therefore, affected by a vulnerability. An unauthenticated file deletion vulnerability in the Palo Alto...

CVE-2024-10626

The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteuploadedfile function in all versions up to, and including, 17.7. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-10470

The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation and permissions checks in the readfile and unlink functions in all versions up to, and including, 4.962. This makes it...

CVE-2024-11585

The WP Hide & Security Enhancer plugin for WordPress is vulnerable to arbitrary file contents deletion due to a missing authorization and insufficient file path validation in the file-process.php in all versions up to, and including, 2.5.1. This makes it possible for unauthenticated attackers to...

CVE-2024-31474

There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI Aruba's Access Point management protocol. Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to...

CVE-2024-57452

ChestnutCMS =1.5.0 has an arbitrary file deletion vulnerability in contentcore.controller.FileController, which allows attackers to delete any file and folder...

CVE-2024-57452

CVE-2024-57452 affects ChestnutCMS &lt;= 1.5.0 where the vulnerability resides in contentcore.controller.FileController, enabling arbitrary file deletion (delete any file/folder). Root cause: inadequate access control/input handling in the file deletion logic. Impact: potential data loss with hig...

CVE-2024-12267

The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited arbitrary file deletion due to insufficient file path validation in the dndcodedropzuploaddelete function in all versions up to, and including, 1.3.8.5. This makes it possible for unauthenticated...

CVE-2025-22784 WordPress Background Control plugin <= 1.0.5 - CSRF to Arbitrary File Deletion vulnerability

Cross-Site Request Forgery CSRF vulnerability in swedish boy Background Control background-control allows Path Traversal.This issue affects Background Control: from n/a through = 1.0.5...

CVE-2025-0105 Expedition: Arbitrary File Deletion Vulnerability

An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files accessible to the www-data user on the host filesystem...

Major Vulnerabilities Patched in SonicWall, Palo Alto Expedition, and Aviatrix Controllers

Palo Alto Networks has released software patches to address several security flaws in its Expedition migration tool, including a high-severity bug that an authenticated attacker could exploit to access sensitive data. "Multiple vulnerabilities in the Palo Alto Networks Expedition migration tool...

ABB Cylon Aspect 3.08.02 (clearProjectConfigurationAjax.php) File Deletion

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The BMS/BAS controller suffers from an arbitrary file deletion...

CVE-2024-56049 WordPress WPLMS plugin < 1.9.9.5.2 - Subscriber+ Arbitrary File Deletion vulnerability

Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS allows Path Traversal.This issue affects WPLMS: from n/a before 1.9.9.5.2...

CVE-2024-56049 WordPress WPLMS plugin < 1.9.9.5.2 - Subscriber+ Arbitrary File Deletion vulnerability

Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplmsplugin allows Path Traversal.This issue affects WPLMS: from n/a through 1.9.9.5.2...

CVE-2024-12363 Insufficient permissions in the TeamViewer Patch & Asset Management component

Insufficient permissions in the TeamViewer Patch & Asset Management component prior to version 24.12 on Windows allows a local authenticated user to delete arbitrary files. TeamViewer Patch & Asset Management is part of TeamViewer Remote Management...

CVE-2024-12363

The CVE-2024-12363 issue affects TeamViewer Patch & Asset Management (part of TeamViewer Remote Management) in Windows prior to version 24.12. The vulnerability stems from insufficient permissions, allowing a local authenticated user to delete arbitrary files. Reported CVSSv3.1 base score is 7.1 ...

CVE-2024-12363 Insufficient permissions in the TeamViewer Patch & Asset Management component

Insufficient permissions in the TeamViewer Patch & Asset Management component prior to version 24.12 on Windows allows a local authenticated user to delete arbitrary files. TeamViewer Patch & Asset Management is part of TeamViewer Remote Management...