CVE-2020-21363

An arbitrary file deletion vulnerability exists within Maccms10...

Cross-Site Request Forgery (CSRF) in dolibarr/dolibarr

✍️ Description In Bank section the Bank | Cash part, you protect List entities to delete with CSRF attacks but if I set CSRF token to nothings then I able to delete arbitrary List entities only with knowing their ids. 🕵️‍♂️ Proof of Concept // PoC.html history.pushState'', '', '/' input...

PT-2021-15855 · WordPress · Listeo

Name of the Vulnerable Software and Affected Versions: Listeo WordPress theme versions prior to 1.6.11 Description: The issue allows any authenticated users to delete arbitrary pages/posts and bookings via an IDOR vector because it does not ensure that the post/page and booking to be deleted belo...

CVE-2020-23766

An arbitrary file deletion vulnerability was discovered on htmly v2.7.5 which allows remote attackers to use any absolute path to delete any file in the server should they gain Administrator privileges...

Arbitrary file deletion

Arbitrary File Deletion vulnerability in puppyCMS v5.1 allows remote malicious attackers to delete the file/folder via /admin/functions.php...

WordPress Access Control Error Vulnerability (CNVD-2021-44310)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An Access Control Error vulnerability exists in Realteo WordPress plugin versions prior to 1.2.4,...

Realteo < 1.2.4 - Arbitrary Property Deletion via IDOR

The plugin, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the request, allowing any authenticated users to delete arbitrary properties by tampering with the propertyid parameter. GET...

Arbitrary File Deletion Vulnerability in simcms us***.php File

simcms is a solution for used car website based on PHP+MYSQL. The simcms us.php file has an arbitrary file deletion vulnerability that can be exploited by an attacker to delete arbitrary files...

Arbitrary File Deletion Vulnerability in Nanjing Xindi EcoGod Windows Network Web Edition

Nanjing New Dixon Software Technology Co., Ltd. is a high-tech enterprise specializing in the research, development and sales of industrial control general configuration and embedded software. Nanjing Xindishen Windows Network Web Edition suffers from an arbitrary file deletion vulnerability, whi...

Realia <= 1.4 - Unauthenticated IDOR leading to Arbitrary Post Deletion

While investigating an IDOR issue on a premium theme, allowing arbitrary deletion of Ads, submitted by Vlad Vector, the Realia plugin was found to be the root cause. In fact, having this plugin installed which some themes require can allow unauthenticated attackers to delete arbitrary posts, by...

Arbitrary File Deletion Vulnerability in XiaoCMS

XiaoCms is a web content management system, provides enterprise building system, station system. XiaoCMS suffers from an arbitrary file deletion vulnerability. An attacker can exploit the vulnerability to delete any directory on the server...

Arbitrary file deletion

MonoCMS Blog 1.0 is affected by: Arbitrary File Deletion. Any authenticated user can delete files on and off the webserver php files can be unlinked and not deleted...

Arbitrary file deletion

The installer of Kaspersky VPN Secure Connection prior to 5.0 was vulnerable to arbitrary file deletion that could allow an attacker to delete any file in the system...

File Deletion Vulnerability in SongCMS PHP Version

SongCMS is a PHP MySQL, ASP Access/SQL Server based development , enterprise-oriented , multi-language support , free , open source CMS, to help business users to quickly build and deploy enterprise-level portal . SongCMS arbitrary file deletion vulnerability , an attacker can exploit the...

WordPress KingComposer plugin <= 2.9.2 - Arbitrary Files/Folders Deletion vulnerability

Arbitrary Files/Folders Deletion vulnerability discovered by NinTechNet in WordPress KingComposer plugin versions = 2.9.2. Solution Update the WordPress KingComposer plugin to the latest available version at least 2.9.4...

Multi Scheduler <= 1.0.0 - Arbitrary Record Deletion via CSRF

The lack of CSRF check could allow attacker to delete arbitrary records from the plugin for example Professional ones via a CSRF attack. The issue is not patched, and has ben escalated to WP plugins team on May 29th, 2020 PoC The PoC will be displayed once the issue has been remediated...

OPPO: Arbitrary thread deletion on c.realme.com

Summary: It's possibile to delete any arbitrary thread on c.readme.com since the /eu/api/thread/delete endpoint does not correctly verify if the session of the user is associated with the actual post creator, allowing an attacker to delete any post as if it were his. This would allow an attacker ...

WP GDPR <= 2.1.1 - Multiple Unauthenticated Issues

The plugin is affected by multiple issues, and has been closed from WP repo: - Unauthenticated Stored XSS - Unauthenticated Content spoofing - Unauthenticated Arbitrary comment deletion - Unauthenticated plugin's settings update...

Arbitrary File Deletion Vulnerability in ETA CMS (CNVD-2020-26406)

ETA CMS is a simple, practical and efficient website builder. ETA CMS has an arbitrary file deletion vulnerability that can be exploited by attackers to delete configuration files...

Microsoft Defender Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations. To exploit the vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted command that could exploit the...