duplicate-CVE-2025-4720-

cve-srms-drop-student-path-traversal CVE-2025-4720dupe Eliminación Arbitraria de Archivos en SourceCodester SRMS 1.0 Descripción Existe una vulnerabilidad de path traversal en el endpoint dropstudent.php de SourceCodester Student Result Management System SRMS 1.0. La aplicación toma una entrada...

CVE-2018-11686

CVE-2018-11686 CVE-2018-11686 - Servicio de publicación PHP de FlexPaper RCE = 2.3.6 encontrado por Red Timmy Security Análisis técnico: https://www.exploit-db.com/docs/english/46521-flexpaper-=-2.3.6-remote-code-execution-whitepaper.pdf Aviso de seguridad: desconocido Prueba de concepto: 1...

WordPress SigmaForms Pro plugin <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field vulnerability

Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field vulnerability discovered by Doan Dinh Van in WordPress Plugin SigmaForms Pro – AI Generated Forms versions = 1.4.11...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to deletion of properties (CVE-2025-13465)

Summary Undici is used by IBM Storage Fusion Data Foundation in components odf-console, noobaa-core. This bulletin identifies the steps to take to address the vulnerability in IBM Storage Fusion Data Foundation. CVE-2025-13465 Vulnerability Details CVEID:CVE-2025-13465 DESCRIPTION: Lodash version...

WordPress WP File Download plugin <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter vulnerability

Authenticated Subscriber+ Arbitrary File Deletion via 'remoteurl' Parameter vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin WP File Download versions = 6.3.4...

CVE-2026-66751-Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat-

Aviso de seguridad: los controles de acceso insuficientes permiten la eliminación no autorizada de salas Let's Chat Identificador CVE asignado: CVE-2026-66751 Resumen DELETE /rooms/:room no realiza ninguna comprobación de autorización más allá de requerir un inicio de sesión. Cualquier cuenta pue...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...

CVE-2026-83595

AVideo contains a Cross-Site Request Forgery (CSRF) vulnerability in the plugin/API/set.json.php component. The flaw allows attackers to craft GET requests that bypass CSRF protection, performing state-changing actions on a victim's session without user consent. Concretely, a victim can be naviga...

CVE-2026-83595 AVideo Cross-Site Request Forgery via plugin/API/set.json.php

AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos,...

Telesquare TLR-2855KS6 - Arbitrary File Deletion

An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts. id: CVE-2021-46419 info: name: Telesquare TLR-2855KS6 - Arbitrary File Deletion author: DhiyaneshDK severity: critical description: | An unauthorized file deleti...

CVE-2023-26563-26564-26565

The vendor has reportedly fixed all vulnerabilities detailed as of releases made after 2024. Ruptura InfoSecurity has not verified that these fixes are complete. See vendor comments in https://github.com/RupturaInfoSec/CVE-2023-26563-26564-26565/issues/1. CVE-2023-26563 - Local File Read in ASPCo...

CVE-2024-10470

CVE-2024-10470 WPLMS Learning Management System para WordPress = 4.962 – Lectura y eliminación arbitraria de archivos sin autenticación Descripción El tema WPLMS Learning Management System para WordPress, un tema LMS para WordPress, es vulnerable a la lectura y eliminación arbitraria de archivos...

cve-2019-14206-poc

CVE-2019-14206 - Adaptive Images for WordPress Arbitrary File Deletion 📋 Index 1. About the Vulnerability 2. Prerequisites 3. Installation 4. Testing Methods Quick Test Full Test with Docker Test with Nuclei Manual Test 5. Interpreting Results 6. Cleanup 7. Troubleshooting 8. Mitigation 9. Legal...

Seecret.it

📦 Seecret.it — Compartición segura mediante enlace de un solo uso Seecret.it es un servicio en línea que permite compartir contraseñas, documentos o información sensible a través de enlaces cifrados y de un solo uso. Tus datos permanecen invisibles, seguros y se autodestruyen tras su consulta...

CVE-2026-19952

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the movefolders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the...

CVE-2025-62950-PoC

Descripción Esta prueba de concepto PoC describe una vulnerabilidad de falsificación de solicitudes entre sitios Cross-Site Request Forgery, CSRF encontrada en el plugin Contest Gallery – Upload, Vote & Sell with PayPal and Stripe v. 26.1.2. El problema permite a un atacante engañar a un usuario...

CVE-2026-19952

The Frontend Admin by DynamiApps WordPress plugin (versions ≤ 3.29.12 ) is vulnerable to unauthenticated arbitrary file deletion caused by insufficient file path validation in the move_folders function, specifically via the custom_directory_name Merge Tag. Discovered by nudien , the flaw allows a...

EUVD-2026-68973

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the movefolders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the...

CVE-2026-19952 Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the movefolders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the...

CVE-2026-75458

The teacher-end interface POST /api/teacher/user/delete/id in XueZhiSi Open Source Exam System = 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserByIdid, setDeletedtrue, updateByIdFilter in sequence, without any validation of...