RazerEoP

RazerEoP PoC для произвольного удаления/перемещения файлов в модуле Macro в Razer Synapse 3. Этот модуль позволяет пользователю экспортировать созданные макросы в файл на диске, а файловая операция выполняется через службу razer, работающую от имени nt authority\system. Я пытался сообщить об этом...

EUVD-2026-71085

GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler. The unlinkoremailfile function accepts parameters prefixed with vfilerow and appends their values directly to a base directory path without sanitizing for directory traversal...

CVE-2024-51747

CVE-2024-51747 Войдите под учётной записью администратора и скачайте базу данных в настройках системы Измените таблицу projecthasfiles в базе данных sqlite.db Сожмите изменённый sqlite.db с помощью gzip и загрузите его. После загрузки в проект и нажатия на файл для просмотра/скачивания...

CVE-2024-2432-PaloAlto-GlobalProtect-EoP

CVE-2024-2432 Palo Alto GlobalProtect EoP Sur un système Windows, il a été constaté que GlobalProtect versions d'application 6.1.1-5 et 6.2.0-89 était vulnérable à une suppression arbitraire de fichier avec des privilèges élevés par attaque de lien symbolique, conduisant à une escalade de...

Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Delete

Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to delete any file, even system internal files, via a DELETE request. id: CVE-2021-46424 info: name: Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Delete author: gy741 severity:...

CVE-2026-75855

Заголовок Path Traversal в командах сервера "create database" / "drop database" позволяет произвольную запись и удаление файлов за пределами настроенной директории базы данных Краткое описание Команды create database и drop database конечной точки POST /api/v1/server используют имя базы данных,...

CVE-2024-21111

CVE-2024-21111 Oracle VirtualBox до версии 7.0.16 уязвим для локального повышения привилегий через переход по символическим ссылкам, что приводит к произвольному удалению файлов и произвольному перемещению файлов. VirtualBox пытается перемещать файлы журналов как NT AUTHORITY\SYSTEM в...

SysmonEoP

SysmonEoP Доказательство концепции для произвольного удаления/записи файлов в Sysmon CVE-2022-41120/CVE-2022-44704 Уязвимость Уязвимость находится в коде, отвечающем за событие ClipboardChange, к которому можно обратиться через RPC. Локальные пользователи могут отправлять данные на RPC-сервер,...

CVE-2026-73040

CVE-2026-73040 is a path traversal vulnerability in Dockge , a Docker Compose management tool. The stack-name allow-list check (^[a-z0-9_-]+$) is enforced only in the write path (save()), while read and delete operations (Stack.getStack, path getter) pass the name directly to path.join without va...

EUVD-2026-63102

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without...

EUVD-2026-62199

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync,...

CVE-2026-52875

Streambert is a cross-platform Electron desktop app for streaming and downloading video. Prior to 2.6.0 , the perform-scheduled-backup IPC handler in src/ipc/storage.js accepts settings.path from a renderer-supplied object and performs filesystem operations (fs.mkdirSync, fs.writeFileSync, fs.rea...

CVE-2026-75855

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

CVE-2026-75855 ArcadeDB before 26.8.1 Path Traversal via create/drop database

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

PT-2026-78237

Name of the Vulnerable Software and Affected Versions Streambert versions prior to 2.6.0 Description The perform-scheduled-backup IPC handler in src/ipc/storage.js fails to verify if the settings.path provided by a renderer-supplied object is within an authorized backup location. This allows a...

CVE-2026-73653

Vitest (framework powered by Vite) has a vulnerability in Browser Mode provider commands prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6. The commands—upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces—accept browser-supplied file paths without enforcin...

CVE-2026-73653 Vitest: Browser Mode provider commands bypass the file-access permission gate

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...

PT-2026-71737

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...

CVE-2026-72604 Intelliants Subrion CMS - Path Traversal

A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink without sanitization or path...

CVE-2026-72880

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, and packages/server/src/services/certificate.ts joins that value to the certificate root withou...