CVE-2021-45427

Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal. An attacker can browse and delete files without any authentication due to incorrect access control and directory traversal...

CVE-2021-45427

Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal. An attacker can browse and delete files without any authentication due to incorrect access control and directory traversal...

Directory traversal

Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal. An attacker can browse and delete files without any authentication due to incorrect access control and directory traversal...

CVE-2021-45427

CVE-2021-45427 affects Emerson XWEB 300D EVO 3.0.7—3ee403. The issue is a path traversal/authentication bypass that allows unauthenticated deletion of arbitrary files due to incorrect access control. Multiple connected sources confirm the vulnerability exists in this product/version and describe ...

CVE-2021-45427

Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal. An attacker can browse and delete files without any authentication due to incorrect access control and directory traversal...

CVE-2021-45427: Improper Limitation of a Pathname to a Restricted Directory

Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal. An attacker can browse and delete files without any authentication due to incorrect access control and directory traversal...

Emerson XWEB 300D EVO 路径遍历漏洞

The Emerson XWEB 300D EVO is an energy efficient air conditioner from Emerson USA. A security vulnerability exists in Emerson XWEB 300D EVO 3.0.7--3ee403, which stems from incorrect access control and directory traversal. An attacker can exploit the vulnerability to browse and delete files withou...

PT-2021-24237

Name of the Vulnerable Software and Affected Versions: Emerson XWEB 300D EVO version 3.0.7--3ee403 Description: The issue allows for unauthenticated arbitrary file deletion due to path traversal. An attacker can browse and delete files without any authentication due to incorrect access control an...

Error Log Viewer < 1.1.2 - Arbitrary Text File Deletion via CSRF

The plugin does not perform nonce check when deleting a log file and does not have path traversal prevention, which could allow attackers to make a logged in admin delete arbitrary text files on the web server. PoC On Web Servers other than Windows, the...

WordPress Error Log Viewer plugin <= 1.1.1 - Arbitrary Text File Deletion via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Text File Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by apple502j in WordPress Error Log Viewer plugin versions = 1.1.1. Solution Update the WordPress Error Log Viewer plugin to the latest available version at least 1.1.2...

Arbitrary File Deletion Vulnerability in BossCMS of Wenzhou Huyin Information Technology Co.

BossCMS is a content management system based on self-developed PHP framework MySQL architecture developed by Wenzhou Huyin Information Technology Co. BossCMS has an arbitrary file deletion vulnerability, which can be exploited by attackers to delete arbitrary files...

CVE-2020-20944

An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files...

CVE-2020-20944

An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files...

Arbitrary file deletion

An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variable...

Design/Logic Flaw

An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files...

CVE-2020-20944

Qibosoft v7 is affected by an arbitrary file deletion vulnerability via /admin/index.php?lfj=mysql&action=del. The root cause is the action=del parameter enabling deletion, as described in PT-2021-10556. Impact: potential unauthorized file removal. Remediation: restrict access to the /admin/index...

CVE-2020-20944

An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files...

CVE-2020-20944: Improper Limitation of a Pathname to a Restricted Directory

An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files...

PT-2021-10556 · Qibosoft · Qibosoft

Name of the Vulnerable Software and Affected Versions: Qibosoft version 7 Description: The issue allows attackers to arbitrarily delete files through the /admin/index.php?lfj=mysql&action=del endpoint. The action parameter is used with the value del to perform the deletion. Recommendations: For...

Qibosoft qibosoft 路径遍历漏洞

Qibosoft qibosoft is a content management system CMS from Qibosoft, a Chinese company. qibosoft is vulnerable to licensing issues, which can be exploited by attackers to arbitrarily delete files...