Telesquare TLR-2855KS6 - Arbitrary File Deletion

An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts. id: CVE-2021-46419 info: name: Telesquare TLR-2855KS6 - Arbitrary File Deletion author: DhiyaneshDK severity: critical description: | An unauthorized file deleti...

Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion

The Avada Fusion Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybedeletefiles function. An unauthenticated attacker can delete arbitrary files on the server by manipulating the filepath parameter in the...

Meta Box <= 5.11.1 - Arbitrary File Deletion

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxdeletefile function. This makes it possible for authenticated attackers with Contributor-level access and above to delete arbitrary files on the server. id: CVE-2026-3946...

CVE-2018-11686

CVE-2018-11686 CVE-2018-11686 - FlexPaper PHP Publish Service RCE = 2.3.6 found by Red Timmy Security Technical Analysis: https://www.exploit-db.com/docs/english/46521-flexpaper-=-2.3.6-remote-code-execution-whitepaper.pdf Security advisory: unknow Proof Of Concept: 1. Removing the config files T...

CVE-2023-21752

CVE-2023-21752 PoC for arbitrary file delete vulnerability in Windows Backup service. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21752 This repo contains two exploits: v1 - Just perform file delete of user choice v2 - Tries to abuse arb delete to spawn elevated cmd shell not...

EUVD-2026-101660

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise validates archive entry names but extracts them directly into the authorized live destination before validating resolved paths. If that destination already contains a...

CVE-2026-104109

Prior to version 3.23.0 , the FileRise self-hosted web-based file manager is vulnerable to a flaw where it validates archive entry names but extracts them into the destination before validating resolved paths. An authenticated non-administrator with extract permissions can exploit this by uploadi...

CVE-2026-107594

The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the...

cve-2019-14206-poc

CVE-2019-14206 - Adaptive Images for WordPress Arbitrary File Deletion 📋 Index 1. About the Vulnerability 2. Prerequisites 3. Installation 4. Testing Methods Quick Test Full Test with Docker Test with Nuclei Manual Test 5. Interpreting Results 6. Cleanup 7. Troubleshooting 8. Mitigation 9. Legal...

EUVD-2026-100893

The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the...

CVE-2026-107594

The File Upload to Order WordPress plugin, prior to version 1.1.4 , is vulnerable to unauthenticated arbitrary file deletion . The flaw occurs because the plugin fails to validate or confine a file path derived from attacker-controlled session data before performing a deletion action. Since this ...

CVE-2026-107594 File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion

The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the...

USN-8925-1 libyaml-perl vulnerabilities

Dominique Dumont discovered that YAML-LibYAML did not correctly handle certain reflection operations. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to delete files. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS...

USN-8925-1: YAML-LibYAML vulnerabilities

Dominique Dumont discovered that YAML-LibYAML did not correctly handle certain reflection operations. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to delete files. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS...

CVE-2026-107652

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary non-form-tag submission fields in its db7forms row and the processbulkaction delete handler then matchin...

EUVD-2026-100766

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary non-form-tag submission fields in its db7forms row and the processbulkaction delete handler then matchin...

CVE-2026-107652

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 1.4.1 . The root cause is that the plugin stores arbitrary submission fields in its db7_forms row. The process_bulk_action() delete handler matches any store...

CVE-2026-107652 Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary non-form-tag submission fields in its db7forms row and the processbulkaction delete handler then matchin...

Linux Distros Unpatched Vulnerability : CVE-2026-78355

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended...

PT-2026-113672

The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the...