Medical Certificate Generator App SQL注入漏洞

The Medical Certificate Generator App is a simple web application for medical clinics. A SQL injection vulnerability exists in Medical Certificate Generator App, which stems from the id parameter of the deleterecord method on the function.php page, which can lead to an SQL injection...

WordPress plugin Wicked Folders 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

CVE-2023-24199

Raffle Draw System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at deleteticket.php...

Raffle Draw System SQL注入漏洞

Raffle Draw System is a simple lottery system by Carlo Montero Personal Developer. A security vulnerability exists in Raffle Draw System that stems from an SQL injection issue in the id parameter of the deleteticket.php page...

GET based CSRF on delete user functionality

Description The /account/delete functionality is vulnerable to CSRF. In this way, an attacker can trick the victim to delete his own account just clicking on the link. Steps to reproduce - Login with a user - Now go here: https://app.wallabag.it/account/delete - The account is now deleted without...

CVE-2023-20854

VMware Workstation contains an arbitrary file deletion vulnerability. A malicious actor with local user privileges on the victim's machine may exploit this vulnerability to delete arbitrary files from the file system of the machine on which Workstation is installed...

CVE-2021-36569

Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2...

CVE-2021-36425

Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in include/incact/actftptakeover.php file...

CVE-2021-36433

SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jodeletemask function in jocms/apps/mask/mask.php...

Directory traversal

Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in include/incact/actftptakeover.php file...

Vulnerability fixed in VMWare Workstation

VMWare has fixed a vulnerability in VMWare Workstation. A local malicious party could exploit the vulnerability to remove arbitrary delete files from the system on which Workstation is installed. VMWare has released updates to fix the vulnerability in Workstation 17.0.1. For more information, see...

CVE-2021-36425

Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in include/incact/actftptakeover.php file...

PT-2023-12290 · Fuel Cms · Fuel Cms

Name of the Vulnerable Software and Affected Versions: FUEL-CMS version 1.4.13 Description: The issue allows remote attackers to run arbitrary code via post ID to the "/users/delete/2" API endpoint. This is a Cross Site Request Forgery vulnerability. Recommendations: For FUEL-CMS version 1.4.13, ...

VMware Workstation 代码注入漏洞

VMware Workstation is a set of virtual machine software from VMware. The software provides the ability to run multiple virtual machines with different operating systems at the same time. A code injection vulnerability exists in VMware Workstation 17.x series versions prior to 17.0.1, which can be...

CVE-2023-0454

OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. This is possible because the application uses an unsanitized attacker-controlled parameter to construct an internal path...

CVE-2023-0454

OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. This is possible because the application uses an unsanitized attacker-controlled parameter to construct an internal path...

CVE-2023-22900

Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database...

The vulnerability of the WebUI user interface of the Oracle Primavera Gateway integration platform allows a malicious individual to gain unauthorized access to read, modify, or delete data.

The vulnerability of the WebUI user interface of the Oracle Primavera Gateway data integration platform is related to insufficient validation of entered data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to read, modify, or delete data usi...

CVE-2022-41991

A heap-based buffer overflow vulnerability exists in the m2m DELETEFILE cmd functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network request can lead to a heap buffer overflow. An attacker can send a network request to trigger this vulnerability...

CVE-2022-40222

An OS command injection vulnerability exists in the m2m DELETEFILE cmd functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability...