401 matches found
CVE-2025-60710
CVE-2025-60710 Это PoC для уязвимости локального повышения привилегий в запланированной задаче \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration. При запуске этой запланированной задачи процесс taskhostw.exe пытается открыть каталог C:\Users%username%\AppData\Local\CoreAIPlatform.00\UKP и...
CVE-2019-0986
Исследования безопасности ради развлечения Все сосредоточено на ОС Microsoft Windows CVE-2019-0986 https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-0986 Это PoC, который я отправил в Microsoft, когда сообщал об указанной уязвимости Этот PoC эксплуатирует "User Profile...
CVE-2026-78074 Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions
Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected...
CVE-2025-60710
CVE-2025-60710 Это PoC для уязвимости локального повышения привилегий в запланированной задаче \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration. При запуске этой запланированной задачи процесс taskhostw.exe пытается открыть каталог C:\Users%username%\AppData\Local\CoreAIPlatform.00\UKP и...
WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Deletion vulnerability
Subscriber+ Arbitrary File Deletion vulnerability discovered by Artus KG and Shhriyash in WordPress Plugin Workeera versions 1.0.6...
CVE-2026-13169 Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR
The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...
CVE-2026-74044
Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...
CVE-2026-74044 Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello
Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...
EUVD-2026-61076
Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...
CVE-2026-74044
Wazuh versions 4.0.0 through 4.14.5 are vulnerable: an authenticated cluster peer with a valid Fernet key can supply a path-traversal-shaped node name in the cluster hello payload; on disconnect, the master's peer cleanup routine deletes arbitrary directory contents within the wazuh user's writab...
CVE-2026-74044 Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello
Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...
WordPress WP Photo Album Plus plugin < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal vulnerability
Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Photo Album Plus versions 9.2.07.002...
EUVD-2026-60781
Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...
CVE-2026-40506
OpenEMR before 8.2.0 contains a path traversal vulnerability in the standardtablesmanage.php interface where the db GET parameter is passed without validation to tempdircleanup, which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers ca...
CVE-2026-40506 OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php
OpenEMR before 8.2.0 contains a path traversal vulnerability in the standardtablesmanage.php interface where the db GET parameter is passed without validation to tempdircleanup, which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers ca...
CVE-2026-40506 OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php
OpenEMR before 8.2.0 contains a path traversal vulnerability in the standardtablesmanage.php interface where the db GET parameter is passed without validation to tempdircleanup, which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers ca...
CVE-2026-40506 OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php
OpenEMR before 8.2.0 contains a path traversal vulnerability in the standardtablesmanage.php interface where the db GET parameter is passed without validation to tempdircleanup, which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers ca...
CVE-2026-75044
In JetBrains YouTrack before versions 2025.3.156085, 2026.1.13914, and 2026.2.18095, a missing authorization check on the mailbox endpoint allowed any authenticated user to delete arbitrary entities, causing high integrity and availability impact (CVSS 8.1). No in-the-wild exploitation is reporte...
