24054 matches found
CVE-2026-48052
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of...
CVE-2026-48052 Papra: Cross-organization tag deletion and modification via authenticated cross-tenant request
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of...
CVE-2026-48052
CVE-2026-48052 affects Papra’s document management platform. Before version 26.5.0, an authenticated user who belongs to any organization could delete or rename tags belonging to a different organization. The URL contains the organizationId, but the repository write filter checked only tag.id, so...
CVE-2026-48052
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of...
EUVD-2026-49391
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of...
CVE-2026-48052 Papra: Cross-organization tag deletion and modification via authenticated cross-tenant request
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of...
CVE-2026-66397 phpMyFAQ before 4.1.6 Path Traversal via category image deletion
phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existingimage field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in Image::delete. Attackers can delete the database.php configuration file to...
CVE-2026-66397 phpMyFAQ before 4.1.6 Path Traversal via category image deletion
phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existingimage field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in Image::delete. Attackers can delete the database.php configuration file to...
CVE-2026-66397
CVE-2026-66397 affects phpMyFAQ prior to 4.1.6. It fails to validate path traversal in the existing_image field during category updates, allowing an authenticated user to delete arbitrary files via Image::delete(), including the database.php config file. This can disable the installation gate and...
CVE-2026-66397
phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existingimage field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in Image::delete. Attackers can delete the database.php configuration file to...
CVE-2026-66397 phpMyFAQ before 4.1.6 Path Traversal via category image deletion
phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existingimage field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in Image::delete. Attackers can delete the database.php configuration file to...
CVE-2026-66476
Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...
CVE-2026-65436
Editor Arbitrary File Deletion in Kirki = 6.0.13 versions...
CVE-2026-65878
Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder 6.7.1- Improper path validation and ACL checks lead to a file deletion vector in the media manager...
CVE-2026-66476 WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability
Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...
CVE-2026-66476
Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...
EUVD-2026-49251
Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...
CVE-2026-66476
CVE-2026-66476 affects WordPress with the Easy Digital Downloads plugin (≤ 3.6.9). The vulnerability is described as Administrator Arbitrary File Deletion in affected versions. The provided metrics indicate network access with high privileges required and UI none, resulting in high availability i...
CVE-2026-65436
CVE-2026-65436 affects the WordPress Kirki plugin up to version 6.0.13, with an Editor component vulnerability described as Arbitrary File Deletion. The connected data confirms the affected software/component and the nature of the vulnerability, but does not provide technical steps, exploit detai...