CVE-2026-118191

The NextGEN Gallery plugin for WordPress (versions up to and including 4.5.5 ) is vulnerable to arbitrary file deletion due to insufficient file path validation in the handle_job function. This flaw allows authenticated attackers with custom-level access (or higher) to delete files on the server,...

CVE-2026-118191 Photo Gallery, Sliders, Proofing and Themes <= 4.5.5 - Authenticated (Custom+) Arbitrary File Deletion via 'task_list' and 'app_config' Parameters

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handlejob function in all versions up to, and including, 4.5.5 This makes it possible for authenticated attackers, with...

CVE-2017-8853

Fiyo CMS v2.0.7 has an arbitrary file delete vulnerability in dapur/apps/appconfig/controller/backuper.php via directory traversal in the file parameter during an act=db action...

CVE-2017-13778: Improper Neutralization of Input During Web Page Generation

Fiyo CMS 2.0.7 has XSS in dapur\apps\appconfig\sysconfig.php via the sitename parameter...