HTML2WP <= 1.0.0 - Subscriber+ Arbitrary File Deletion

The plugin does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file To delete the license.txt at the root of the blog: await...

HTML2WP <= 1.0.0 - Subscriber+ Arbitrary File Deletion

The plugin does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file PoC To delete the license.txt at the root of the blog: await...

Online Car Wash Booking System 安全漏洞

Online Car Wash Booking System is an online car wash booking system by Carlo Montero. v1.0 of Online Car Wash Booking System is vulnerable to an arbitrary file deletion vulnerability in /ocwbs/classes/Master.php? f=deleteimg page lacks validation for file names, which can be exploited to cause...

Rescue Dispatch Management System 安全漏洞

Rescue Dispatch Management System is a rescue dispatch management system developed by Carlo Montero. v1.0 of Rescue Dispatch Management System is vulnerable to an arbitrary file deletion vulnerability in /rdms/classes/ Master.php?f=deleteimg lacks valid validation for file names, which can be...

WordPress HTML2WP plugin <= 1.0.0 - Authenticated Arbitrary File Deletion vulnerability

Authenticated Arbitrary File Deletion vulnerability discovered by Daniel Ruf in WordPress HTML2WP plugin versions = 1.0.0. Solution Deactivate and delete. This plugin has been closed as of May 4, 2022 and is not available for download. This closure is temporary, pending a full review...

elitecms 路径遍历漏洞

Elitecms is a web content management from elitecms India. elitecms version 1.01 has an arbitrary file deletion vulnerability that can be exploited by attackers to delete any file...

CVE-2022-31973

Online Fire Reporting System v1.0 is vulnerable to Delete any file via /ofrs/classes/Master.php?f=deleteimg...

CVE-2022-31973

CVE-2022-31973 affects the Online Fire Reporting System v1.0. The vulnerability arises in the file path /ofrs/classes/Master.php?f=delete_img, where filenames are not properly validated, enabling arbitrary file deletion. This is described consistently across multiple sources in the connected docu...

CVE-2022-31945

Rescue Dispatch Management System v1.0 is vulnerable to Delete any file via /rdms/classes/Master.php?f=deleteimg...

CVE-2022-31945

CVE-2022-31945 affects Rescue Dispatch Management System v1.0. The vulnerability enables arbitrary file deletion via /rdms/classes/Master.php?f=delete_img due to missing validation for file names in the delete_img path. Impact is described as arbitrary file deletion with high integrity and availa...

CVE-2022-31342

Online Car Wash Booking System v1.0 is vulnerable to Delete any file via /ocwbs/classes/Master.php?f=deleteimg...

OS Command Injection in file editor

Description Deploy and run gogs. Proof of Concept 1. Create a repository and upload a file named config to the repository repo6. The content of the file is as follows: xml core repositoryformatversion = 0 filemode = true bare = false logallrefupdates = true ignorecase = true precomposeunicode =...

PT-2022-20991

Name of the Vulnerable Software and Affected Versions Rescue Dispatch Management System version 1.0 Description The issue allows deletion of any file via the "Master.php" file. Specifically, the /rdms/classes/Master.php API endpoint is vulnerable when the f parameter is set to delete img. This...

CVE-2022-31966: Undefined Security Weakness

ChatBot App with Suggestion v1.0 is vulnerable to Delete any file via /simplechatbot/classes/Master.php?f=deleteimg...

CVE-2022-31945: Undefined Security Weakness

Rescue Dispatch Management System v1.0 is vulnerable to Delete any file via /rdms/classes/Master.php?f=deleteimg...

PT-2022-21008

Name of the Vulnerable Software and Affected Versions Online Fire Reporting System version 1.0 Description The issue allows deletion of any file via the "/ofrs/classes/Master.php?f=delete img" API endpoint. Recommendations For Online Fire Reporting System version 1.0, restrict access to the...

PT-2022-20698

Name of the Vulnerable Software and Affected Versions Online Car Wash Booking System version 1.0 Description The issue allows deletion of any file via the "/ocwbs/classes/Master.php?f=delete img" API endpoint. Recommendations For Online Car Wash Booking System version 1.0, consider restricting...

CVE-2022-31342: Undefined Security Weakness

Online Car Wash Booking System v1.0 is vulnerable to Delete any file via /ocwbs/classes/Master.php?f=deleteimg...

CVE-2022-31973: Undefined Security Weakness

Online Fire Reporting System v1.0 is vulnerable to Delete any file via /ofrs/classes/Master.php?f=deleteimg...

PT-2022-21004

Name of the Vulnerable Software and Affected Versions ChatBot App with Suggestion version 1.0 Description The issue allows deletion of any file via the /simple chat bot/classes/Master.php API endpoint with the f parameter set to delete img. Recommendations For ChatBot App with Suggestion version...