CVE-2026-77693

The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the si...

CVE-2026-77757

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...

CVE-2026-77693

The Order Tip for WooCommerce WordPress plugin (versions before 1.6.0 ) contains an arbitrary file deletion vulnerability in the delete_exported_csv_file_ajax function. The plugin fails to verify the requesting user's capability or restrict the file path, allowing authenticated users with the Sho...

EUVD-2026-66283

The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the si...

CVE-2026-77693 Order Tip for WooCommerce < 1.6.0 - Shop Manager+ Arbitrary File Deletion via delete_exported_csv_file_ajax

The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the si...

Linux Distros Unpatched Vulnerability : CVE-2026-34968

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database- list drop action fails to validate file extensions...

CVE-2026-77139

The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files...

CVE-2026-77139 Path Traversal in extension "Mask" (mask)

The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files...

CVE-2026-77139

CVE-2026-77139 is a path traversal vulnerability in the Mask (mask) extension for TYPO3 . The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask m...

EUVD-2026-65337

The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files...

CVE-2026-72695

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the...

CVE-2026-34968

Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db parameter to delete any files writable by the P...

DEBIAN-CVE-2026-34968

Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db parameter to delete any files writable by the P...

CVE-2026-34968

Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db parameter to delete any files writable by the P...

UBUNTU-CVE-2026-34968

Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db parameter to delete any files writable by the P...

CVE-2026-72695

Grav (flat-file CMS) before 2.0.16 is affected by a path traversal vulnerability in MediaUploadTrait::deleteFile(). The method validates only the basename portion of a supplied filename while leaving unvalidated directory paths containing ../ sequences intact, passing the full path to unlink(). T...

CVE-2026-72695 Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the...

CVE-2026-72695 Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the...

EUVD-2026-65209

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the...

CVE-2026-34968

Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db parameter to delete any files writable by the P...