CVE-2018-5756

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for folder-to-object association, which allows remote authenticated users to delete arbitrary tasks via the task id in a...

Open redirect

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for folder-to-object association, which allows remote authenticated users to delete arbitrary tasks via the task id in a...

CVE-2018-10758

The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles...

Cross site request forgery (csrf)

The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles...

CVE-2018-10758

The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles...

CVE-2018-10758: Cross-Site Request Forgery (CSRF)

The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles...

Gxlcms QY Arbitrary File Deletion Vulnerability

Gxlcms QY is an enterprise website creation system. A security vulnerability exists in the Lib\Lib\Action\Admin\DataAction.class.php file in Gxlcms QY version 1.0.0713. A remote attacker can exploit this vulnerability by deleting arbitrary files with the 'id' parameter in the Admin-Data-del reque...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers to hijack the authentication of arbitrary users for requests that 1 delete e-mail messages via a delete action in a request to secmail/getmessage.exe or 2 spoof arbitrary users a...

CVE-2018-5375

Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecpspace.php appid parameter in a delete action...

Design/Logic Flaw

Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecpspace.php appid parameter in a delete action...

CVE-2018-5375

Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecpspace.php appid parameter in a delete action...

Techno - Portfolio Management Panel Access Control Vulnerability

Techno - Portfolio Management Panel is a set of portfolio management panel scripts. An access control vulnerability exists in Techno - Portfolio Management Panel on 2017-11-16 and prior versions, which stems from the program failing to detect if a panel/portfolio.php?action=delete request is...

CVE-2017-14347

NexusPHP 1.5.beta5.20120707 has XSS in the returnto parameter to fun.php in a delete action...

Design/Logic Flaw

NexusPHP 1.5.beta5.20120707 has XSS in the returnto parameter to fun.php in a delete action...

CVE-2017-14347

NexusPHP 1.5.beta5.20120707 is affected by an XSS vulnerability in the returnto parameter of fun.php during a delete action. Descriptions in CVE records and CNVD/NVD references indicate the issue allows script injection in NexusPHP’s admin-facing flow, with CNVD noting potential to obtain the adm...

CVE-2017-14347: Improper Neutralization of Input During Web Page Generation

NexusPHP 1.5.beta5.20120707 has XSS in the returnto parameter to fun.php in a delete action...

CVE-2017-12946

classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators...

CVE-2017-12946: Improper Neutralization of Special Elements used in an SQL Command

classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators...

Arbitrary File Deletion Vulnerability in 'hid_name' in OfficeTen Management System of NetEconomic Technology (Suzhou) Co.

OfficeTen is an enterprise next-generation converged communication product that integrates voice, data, security, and real-time communication applications, developed by Nethru Technology with independent innovation and its own intellectual property rights. Arbitrary file deletion vulnerability...

WordPress Simple Booking Calendar 1.3 Cross Site Request Forgery

Plugin Name : WP Simple Booking Calendar A8-Cross-SiteRequestForgeryCSRF Effected Version : 1.3 and most probably lower version's if any Vulnerability : A8-Cross-Site Request Forgery CSRF Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Unauthenticated PoC - Proof ...