13430 matches found
CVE-2022-1953
The CVE-2022-1953 entry concerns the WordPress Product Configurator for WooCommerce plugin prior to version 1.2.32. The vulnerability is an arbitrary file deletion via an unauthenticated AJAX action that accepts user input used in a filesystem path and passed to unlink() without validation. This ...
CVE-2022-1572
CVE-2022-1572: The HTML2WP WordPress plugin (versions
CVE-2022-1572 HTML2WP <= 1.0.0 - Subscriber+ Arbitrary File Deletion
The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file...
WordPress plugin WooCommerce 路径遍历漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress WooCommerce plugin versions prior to 1.2.32 are vulnerable to arbitrary file deletion, which stems...
WordPress plugin HTML2WP 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress HTML2WP plugin 1.0.0 and earlier versions have an arbitrary file deletion vulnerability, th...
PT-2022-14213
Name of the Vulnerable Software and Affected Versions Product Configurator for WooCommerce WordPress plugin versions prior to 1.2.32 Description The issue allows unauthenticated users to delete arbitrary files via an AJAX action. This is possible because the AJAX action accepts user input that is...
CVE-2022-1953: Improper Limitation of a Pathname to a Restricted Directory
The Product Configurator for WooCommerce WordPress plugin before 1.2.32 suffers from an arbitrary file deletion vulnerability via an AJAX action, accessible to unauthenticated users, which accepts user input that is being used in a path and passed to unlink without validation first...
CVE-2022-33121
A CSRF vulnerability in MiniCMS v1.11 allows attackers to delete local .dat files by clicking a malicious link. This has been reported across multiple feeds (including CNVD, Red Hat, NVD/OSV, CVE lists). The root cause is a CSRF in MiniCMS v1.11; there are no public exploit details within the pro...
CVE-2022-30117
Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changin...
CVE-2022-1965
Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In consequence, the file referenced by the request could be deleted. User interaction is not required...
Design/Logic Flaw
Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In consequence, the file referenced by the request could be deleted. User interaction is not required...
CVE-2022-1965 CODESYS runtime system prone to file deletion due to improper error handling
Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In consequence, the file referenced by the request could be deleted. User interaction is not required...
CVE-2022-1965
CVE-2022-1965 concerns multiple CODESYS products with an improper error handling flaw. A low-privilege, remote attacker can craft a network request that is not properly processed by the error handling, potentially causing deletion of the file referenced by that request. No user interaction is req...
CVE-2022-1965: Improper Handling of Exceptional Conditions
Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In consequence, the file referenced by the request could be deleted. User interaction is not required...
PT-2022-14225 · 3S Smart Software Solutions · Codesys
Name of the Vulnerable Software and Affected Versions: CODESYS affected versions not specified Description: The issue is related to improper error handling in CODESYS products. A low-privilege remote attacker can craft a request that is not properly processed by the error handling, potentially...
PortlandLabs Concrete CMS 路径遍历漏洞
PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. PortlandLabs Concrete CMS is vulnerable to an arbitrary file deletion vulnerability that stems from allowing traversal of /index.php/ccm/system/file/ upload, which can be exploited by...
Fast Food Ordering System Arbitrary File Deletion Vulnerability
Fast Food Ordering System is a fast food ordering system from Carlo Montero's personal developer. version 1.0 of Fast Food Ordering System is vulnerable to an arbitrary file deletion vulnerability, which originates in /ffos/classes/Master.php?f=deleteimg page lacks valid validation and can be...
CVE-2021-46820
Arbitrary File Deletion vulnerability in XOS-Shop xosshopsystem 1.0.9 via currentmanufacturerimage parameter to /shop/admin/categories.php...
