Open redirect

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for folder-to-object association, which allows remote authenticated users to delete arbitrary tasks via the task id in a...

CVE-2018-10758

The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles...

CVE-2018-10758

The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles...

Cross site request forgery (csrf)

The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles...

Gxlcms QY Arbitrary File Deletion Vulnerability

Gxlcms QY is an enterprise website creation system. A security vulnerability exists in the Lib\Lib\Action\Admin\DataAction.class.php file in Gxlcms QY version 1.0.0713. A remote attacker can exploit this vulnerability by deleting arbitrary files with the 'id' parameter in the Admin-Data-del reque...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers to hijack the authentication of arbitrary users for requests that 1 delete e-mail messages via a delete action in a request to secmail/getmessage.exe or 2 spoof arbitrary users a...

CVE-2018-5375

Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecpspace.php appid parameter in a delete action...

Design/Logic Flaw

Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecpspace.php appid parameter in a delete action...

CVE-2018-5375

Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecpspace.php appid parameter in a delete action...

Techno - Portfolio Management Panel Access Control Vulnerability

Techno - Portfolio Management Panel is a set of portfolio management panel scripts. An access control vulnerability exists in Techno - Portfolio Management Panel on 2017-11-16 and prior versions, which stems from the program failing to detect if a panel/portfolio.php?action=delete request is...

CVE-2017-14347

NexusPHP 1.5.beta5.20120707 has XSS in the returnto parameter to fun.php in a delete action...

Design/Logic Flaw

NexusPHP 1.5.beta5.20120707 has XSS in the returnto parameter to fun.php in a delete action...

CVE-2017-14347

NexusPHP 1.5.beta5.20120707 is affected by an XSS vulnerability in the returnto parameter of fun.php during a delete action. Descriptions in CVE records and CNVD/NVD references indicate the issue allows script injection in NexusPHP’s admin-facing flow, with CNVD noting potential to obtain the adm...

CVE-2017-12946

classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators...

Arbitrary File Deletion Vulnerability in 'hid_name' in OfficeTen Management System of NetEconomic Technology (Suzhou) Co.

OfficeTen is an enterprise next-generation converged communication product that integrates voice, data, security, and real-time communication applications, developed by Nethru Technology with independent innovation and its own intellectual property rights. Arbitrary file deletion vulnerability...

WordPress Simple Booking Calendar 1.3 Cross Site Request Forgery

Plugin Name : WP Simple Booking Calendar A8-Cross-SiteRequestForgeryCSRF Effected Version : 1.3 and most probably lower version's if any Vulnerability : A8-Cross-Site Request Forgery CSRF Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Unauthenticated PoC - Proof ...

MediaWiki Unauthorized Operation Vulnerability

MediaWiki is a famous wiki program that runs on PHP+MySQL environment. MediaWiki suffers from an unauthorized operation vulnerability. A remote attacker can exploit this vulnerability by constructing a revisiondelete operation that can be used to delete, revise, ban, etc...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Test/WorkArea/DmsMenu/menuActions/MenuActions.aspx in Ektron Content Management System CMS before 9.10 SP1 Build 9.1.0.184.1.120 allows remote attackers to hijack the authentication of content administrators for requests that delete content via a...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the wp-football plugin 1.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the league parameter to 1 footballclassification.php, 2 footballcriteria.php, 3 templates/templatedefaultpreview.php, or 4...

DEBIAN-CVE-2014-5026

Multiple cross-site scripting XSS vulnerabilities in Cacti 0.8.8b allow remote authenticated users with console access to inject arbitrary web script or HTML via a 1 Graph Tree Title in a delete or 2 edit action; 3 CDEF Name, 4 Data Input Method Name, or 5 Host Templates Name in a delete action; ...