CVE-2020-0753-and-CVE-2020-0754

Writeup and POC for CVE-2020-0753, CVE-2020-0754 and six unfixed Window DOS Vulnerabilities Exploit FileSystem race condition bug - analysis of CVE-2020-0753 and CVE-2020-0754 Windows Error Reporting service has fixed 2 Elevation of Privilege bugs in last Patch Tuesday, the two bugs are assigned...

CVE-2022-30206

CVE-2022-30206 This is the PoC for CVE-2022-30206. Introduction Perform the following operations to arbitrary file deletion： 1. Run the addprinter.exe to create a printer and set the SpoolDirectory in C:\Users\Public\tmp\1. 2. Run the FileLock.exe TargetFile to redirect .SHD file to TargetFile an...

CVE-2026-37065

CVE-2026-37065 Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion. To exploit the vulnerability, an authenticated attacker with the role of superadmin can send a specially crafted POST request to the affected endpoint using the url parameter remove to control the file to be...

The vulnerability of the platform for creating individual web applications in CRM involves an incorrect restriction on the path to the catalog, allowing attackers to delete arbitrary files.

The vulnerability of the platform for creating individual web applications in CRM involves incorrect restrictions on the path to the catalog. Exploiting this vulnerability could allow a malicious actor to delete arbitrary files remotely...

The vulnerability of the Enlogic SCADA system’s virtual controller “ENTEK” arises from improper external control of file names or paths, allowing attackers to delete arbitrary files.

The vulnerability of the Enlogic SCADA system “ENTEK”’s virtual controller is related to incorrect external control using filenames or paths. Exploiting this vulnerability could allow a malicious actor to delete any files at will...

CVE-2023-27470_Exercise

CVE-2023-27470 EoP via Arbirary File Deletion Exercise This repository contains a local privilege escalation exercise that replicates CVE-2023-27470. Your mission, should you choose to accept it, find the vulnerability and get a SYSTEM Command Prompt! If you would like the jump to the solution,...

CVE-2026-48866

┌───────────────────────────────────────────────────────────┐ │ │ │ C V E - 2 0 2 6 - 4 8 8 6 6 │ │ │ │ Gravity Forms Path Traversal → Arbitrary File D...

CVE-2020-26259

CVE-2020-26259 CVE-2020-26259: XStream1.4.14 is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights. https://x-stream.github.io/CVE-2020-26259.html XStream 1.4.14 pom.xml com.thoughtworks.xstream xstream 1.4.14 poc...

CVE-2024-5932

This post is a research article published by EQSTLab. ❗❗ IMPORTANT ❗❗ There are currently fake PoC github repositories running xmrig. Check out the link below for more information : URL1: https://x.com/win3zz/status/1828704644987511107 URL2: https://x.com/bornunique911/status/1828712791844524453...

CVE-2026-24135

CVE-2026-24135: Arbitrary File Deletion in Gogs via Wiki Path Traversal Severity: High CVSS 7.5 Affected Software: Gogs Patched In: 0.13.4, 0.14.0+dev Advisory: GHSA-jp7c-wj6q-3qf2 Patch: gogs/gogs8099 Summary During a security audit of Gogs a popular self-hosted Git service written in Go, I foun...

CVE-2023-20178

CVE-2023-20178 This is PoC for Arbitrary File Delete vulnerability in Cisco Secure Client tested on 5.0.01242 and Cisco AnyConnect tested on 4.10.06079. When a user connect to vpn, vpndownloader.exe process is started in background and it will create directory in c:\windows\temp with default...

CVE-2023-6972-Exploit-Arbitrary-File-Deletion

CVE-2023-6972 Proof of Concept PoC Description This repository contains a Proof of Concept PoC exploit for CVE-2023-6972. The vulnerability allows for Unauthenticated Arbitrary File Deletion AFD in Wordpress Backup Migration Plugin Note: A comprehensive technical breakdown, full case study, and...

VEN0m-Ransomware

VEN0m Ransomware https://github.com/user-attachments/assets/5a1fc9b5-a647-41f6-a152-7b9d97381adc This project demonstartes how a legit, and signed driver can be weponized to evade defenses and deploy ransomware simulating a real cyberattack. 🚨 Tested on Windows 11 Pro 24H2. Fully undetectable as ...

WordPress WP Fastest Cache <= 0.9.0.2 - Authenticated Arbitrary File Deletion

The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capability checking and insufficient path validation. This makes it possible for authenticated users with minimal permissions to delete...

Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion

The Avada Fusion Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybedeletefiles function. An unauthenticated attacker can delete arbitrary files on the server by manipulating the filepath parameter in the...

Nevma Adaptive Images - Arbitrary File Deletion

Nevma Adaptive Images plugin before 0.6.67 for WordPress contains an arbitrary file deletion caused by unsanitized input in adaptive-images-script.php, letting remote attackers delete arbitrary files, exploit requires sending specific request parameters. id: CVE-2019-14206 info: name: Nevma...

Meta Box <= 4.16.2 - Arbitrary File Deletion

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion in the ajaxdeletefile function. The function accepts any attachmentid from the POST request and directly calls wpdeleteattachment or unlink without validating that the attachment belongs to the specified Meta Box field,...

CVE-2026-81648

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-81648 CVE-2026-81648 CryptoPayment Gateway 1.2.2 - Granwill I am @abraxasnull. Loopback lab. The client is CVE-2026-81648-Abraxas-Labs.py. The guard is never called. Direct POST vendor/cryptd/ajax.php, not...

CVE-2024-23773

CVE-2024-23773 - Arbitrary File Delete Vulnerability Information will follow in due course...

CVE-2026-108902

The pH7Builder (pH7 Social Dating CMS) software before version 18.5.0 is vulnerable to a path traversal vulnerability within the picture module 's deletePhoto() action. An authenticated member can exploit this by supplying ../ sequences in the POST picture_link parameter to delete arbitrary files...