CVE-2022-30367

Air Cargo Management System v1.0 is vulnerable to file deletion via /acms/classes/Master.php?f=deleteimg...

CVE-2022-30375

Sourcecodester Simple Social Networking Site v1.0 is vulnerable to file deletion via /sns/classes/Master.php?f=deleteimg...

CVE-2022-30372

Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/classes/Master.php?f=deletecargo...

CVE-2022-30372

Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/classes/Master.php?f=deletecargo...

CVE-2022-30370

Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/classes/Master.php?f=deletecargotype...

TeamPass Improper Privilege Management

TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php. It is then possible for a manager user to delete an arbitrary user including admin, or modify attributes of any arbitrary user except administrator. To exploit the vulnerability, an...

GHSA-X73X-7GMX-W835 Arbitrary file delete in baserCMS

baserCMS version 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to delete arbitrary files via unspecified vectors when the "File" field is being used in the mail form...

Jenkins Config File Provider Plugin XSS vulnerability

An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete t...

GHSA-J99Q-RWP6-498G Gitea Arbitrary File Delete Vulnerability

Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to "any"...

Gitea Arbitrary File Delete Vulnerability

Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to "any"...

Missing permission checks in Jenkins Periodic Backup Plugin allow every user to change settings

The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore backups, download backups, and also delete all previous backups via log rotation. Additionally, the plugin was not requiring requests to it...

Moodle Incorrect Default Settings

The default configuration of Moodle 2.0.x before 2.0.2 has an incorrect setting of the moodle/course:delete capability, which allows remote authenticated users to delete arbitrary courses by leveraging the teacher role...

Moodle allows attackers to remove wiki pages

mod/wiki/admin.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote authenticated users to remove wiki pages by leveraging delete access within a different subwiki...

Mautic Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that 1 delete email campaigns or 2 delete contacts...

elFinder Path Traversal vulnerability

Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process...

GHSA-45X3-MW7Q-WF7F elFinder Path Traversal vulnerability

Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process...

GHSA-377V-8637-6VQ6 TYPO3 femanager extension allows remote frontend users to modify or delete records of other frontend users

The femanager extension before 1.0.9 for TYPO3 allows remote frontend users to modify or delete the records of other frontend users via unspecified vectors...

TYPO3 femanager extension allows remote frontend users to modify or delete records of other frontend users

The femanager extension before 1.0.9 for TYPO3 allows remote frontend users to modify or delete the records of other frontend users via unspecified vectors...

GHSA-7592-93RM-6GPX Injection in Jenkins

A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that allows users to sign up using user names containing control characters that can then appear to have the same name as other users, and canno...

Merchandise Online Store SQL注入漏洞

Merchandise Online Store is a merchandise online store system. merchandise Online Store has a security vulnerability that can be exploited by attackers via /vloggersmerch/classes/Master.php?f=deletesubcategory to conduct an SQL injection attack...