CVE-2022-3899

The 3dprint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will delete any number of files or directories on the target server by tricking a logged ...

CVE-2022-3899

The 3dprint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will delete any number of files or directories on the target server by tricking a logged ...

Cross site request forgery (csrf)

The 3dprint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will delete any number of files or directories on the target server by tricking a logged ...

CVE-2022-3899 3DPrint < 3.5.6.9 - Arbitrary File and Directory Deletion via CSRF

The 3dprint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will delete any number of files or directories on the target server by tricking a logged ...

CVE-2022-3899 3DPrint < 3.5.6.9 - Arbitrary File and Directory Deletion via CSRF

The 3dprint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will delete any number of files or directories on the target server by tricking a logged ...

CVE-2022-3899: Cross-Site Request Forgery (CSRF)

The 3dprint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will delete any number of files or directories on the target server by tricking a logged ...

PT-2024-5115 · Trend Micro +1 · Trend Micro Security +2

Name of the Vulnerable Software and Affected Versions: Trend Micro Security versions 17.x Trend Micro Maximum Security affected versions not specified Description: The issue is related to a Privilege Escalation vulnerability that could allow a local attacker to unintentionally delete privileged...

HTML5 SoundCloud Player <= 2.8.0 - Authenticated (Author+) PHP Object Injection

Description The HTML5 SoundCloud Player with Playlist Free plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.8.0 via deserialization of untrusted input. This makes it possible for authenticated attackers, with author-level access and above, to inje...

PT-2024-5111 · Solarwinds · Solarwinds Access Rights Manager

Name of the Vulnerable Software and Affected Versions: SolarWinds Access Rights Manager affected versions not specified Description: The issue concerns a Directory Traversal and Information Disclosure vulnerability in the SolarWinds Access Rights Manager. This vulnerability allows an...

CVE-2023-6583: Improper Control of Filename for Include/Require Statement in PHP Program

The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurring Import functionality. This makes it possible for authenticated attackers, with administrator access and above, to read and delete the...

CVE-2023-48258

The vulnerability allows a remote attacker to delete arbitrary files on the file system via a crafted URL or HTTP request through a victim’s session...

CVE-2023-48258

CVE-2023-48258 allows a remote attacker to delete arbitrary files on the file system via a crafted URL or HTTP request within a victim’s session. The connected feeds (NVD, Red Hat, PRION, etc.) corroborate the basic impact, but none provide explicit details on affected products, exact versions, e...

CVE-2024-0206

A symbolic link manipulation vulnerability in Trellix Anti-Malware Engine prior to the January 2024 release allows an authenticated local user to potentially gain an escalation of privileges. This was achieved by adding an entry to the registry under the Trellix ENS registry folder with a symboli...

PT-2024-1181

Name of the Vulnerable Software and Affected Versions Bosch Nexo cordless nutrunner and Bosch Nexo special cordless nutrunner affected versions not specified Description The issue is related to a cross-site request forgery vulnerability. It allows a remote attacker to delete arbitrary files on th...

Uncode Core < 2.8.9 - Authenticated (Subscriber+) Arbitrary File Deletion

Description The uncode-core plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 2.8.8. This makes it possible for authenticated attackers with subscriber level access or higher to delete arbitrary files on the site...

Arbitrary file deletion

Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php...

Arbitrary file deletion

S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability...

Store Locator WordPress < 1.4.15 - Admin+ Arbitrary File Deletion

Description The plugin is vulnerable to Directory Traversal, allowing authenticated attackers, with administrator access and above, to delete arbitrary files...

WordPress Backup Migration Plugin < 1.4.0 Multiple Vulnerabilities

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:backupbliss:backupmigration"; if description...

WordPress JVM rich text icons Plugin <= 1.2.6 is vulnerable to Arbitrary File Deletion

Software JVM rich text icons Type Plugin Vulnerable versions = 1.2.6 Fixed in 1.2.7 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2023-51418 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID a73cfe9ec895 Credits Rafie Muhammad...