CVE-2026-42048

CVE-2026-42048 CVE-2026-42048 Langflow Path Traversal / Arbitrary Directory Deletion PoC https://github.com/user-attachments/assets/6e5481ff-e953-47a5-8870-70b30c6550de Description CVE-2026-42048 : Langflow Arbitrary Directory Deletion Vulnerability description: A path traversal vulnerability in...

CVE-2026-33388

An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential value...

CVE-2025-26125

Description The PoC program exploits the IMFForceDelete driver which exposes an ioctl that allows unprivileged users to delete files and folders. We can turn this into a privilege escalation by using a technique explained by ZDI and Halov, which exploits the MSI rollback mechanism which is design...

CVE-2026-66751-Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat-

Security Advisory: Insufficient Access Controls Allow for Unauthorized Room Deletion Let's Chat Assigned CVE ID: CVE-2026-66751 Summary DELETE /rooms/:room performs no authorization check beyond requiring a login. Any account can archive any room on the server, including private, password protect...

CVE-2020-26259

CVE-2020-26259 CVE-2020-26259: XStream1.4.14 is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights. https://x-stream.github.io/CVE-2020-26259.html XStream 1.4.14 pom.xml root@kitploit: com.thoughtworks.xstream xstre...

EUVD-2026-72762

An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential value...

CVE-2026-33388

CVE-2026-33388 is an access control vulnerability in the Credentials Manager functionality of Nozomi Networks Guardian/CMC (affected: versions before 26.3.0 ). The root cause is insufficient validation of user privileges , allowing a remote authenticated user with limited privileges to view a sub...

CVE-2026-33388 Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0

An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential value...

kube-monkey

kube-monkey es una implementación de Chaos Monkey de Netflix para clústeres de Kubernetes. Elimina aleatoriamente pods de Kubernetes k8s en el clúster, fomentando y validando el desarrollo de servicios resilientes a fallos. Únete a nosotros en kube-monkey en Kubernetes Slack. kube-monkey se ejecu...

CVE-2024-23773

CVE-2024-23773 - Arbitrary File Delete Vulnerability Information will follow in due course...

CVE-2023-21752

CVE-2023-21752 PoC para la vulnerabilidad de eliminación arbitraria de archivos en el servicio de Backup de Windows. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21752 Este repositorio contiene dos exploits: v1 - Simplemente realiza la eliminación del archivo elegido por el...

CVE-2023-40362

CVE-2023-40362 CVE-2023-40362 vulnerabilitiy details and proof-of-concept. Overview An access control vulnerability in Click2Gov BP at the URI /Click2GovBP/mastercontractorlist.html leads to the ability for authenticated users to delete the contractors from the accounts of other users with the...

CVE-2019-17234b-Exploit

Wordpress IgniteUp plugin vulnerability Wordpress IgniteUp plugin v3.4 and below allows remote unauthenticated users to potentially arbitrarily delete any file on target webserver possibly causing a Denial of Service attack. CVE-2019-17234 timeline The vulnerability was reported to wordpress.org...

CVE-2024-7856

CVE-2024-7856 ★ CVE-2024-7856 Arbitrary File deletion PoC ★ Description CVE-2024-7856 : MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar -f python3 CVE-2024-7856.py -u -f -i -p...

WordPress EDD Product Catalog Feed by PixelYourSite plugin <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Deletion vulnerability

Authenticated Subscriber+ Arbitrary Options Deletion vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin EDD Product Catalog Feed by PixelYourSite versions = 1.0.2...

CVE-2026-9331

The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcfdeletefeed function in all versions up to, and including, 1.0.2. This makes it possible for...

CVE-2023-26563-26564-26565

The vendor has reportedly fixed all vulnerabilities detailed as of releases made after 2024. Ruptura InfoSecurity has not verified that these fixes are complete. See vendor comments in https://github.com/RupturaInfoSec/CVE-2023-26563-26564-26565/issues/1. CVE-2023-26563 - Local File Read in ASPCo...

CVE-2026-9331

The EDD Product Catalog Feed WordPress plugin by PixelYourSite is affected in all versions up to and including 1.0.2 . The root cause is a missing capability check on the wpeddpcf_delete_feed function, allowing any authenticated user with subscriber-level access or higher to delete arbitrary Word...

CVE-2026-9331 EDD Product Catalog Feed by PixelYourSite <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Deletion via Missing Authorization on 'delete' Parameter

The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcfdeletefeed function in all versions up to, and including, 1.0.2. This makes it possible for...

CVE-2024-10470

CVE-2024-10470 WPLMS Learning Management System for WordPress = 4.962 – Unauthenticated Arbitrary File Read and Deletion Description The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file pat...