CVE-2026-78592

A Path Traversal vulnerability (CWE-22) in Kibana 's tag management interface allows a low-privileged user with tag creation privileges to cause an administrative action to act on an unintended target. This results in the unauthorized deletion of privileged resources , including administrative ac...

EUVD-2026-69573

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding tag creation privileges could cause a subsequent administrative action in the tag...

duplicate-CVE-2025-4720-

cve-srms-drop-student-path-traversal CVE-2025-4720dupe SourceCodester SRMS 1.0 任意文件删除漏洞 描述 SourceCodester 学生成绩管理系统（SRMS）1.0 的 dropstudent.php 端点存在路径遍历漏洞。 该应用程序从 img GET 参数获取用户可控输入，并在未经验证的情况下直接将其传递给 unlink 函数，从而允许删除服务器上的任意文件。 漏洞代码 root@kitploit: $img = $GET'img'; if $img == "DEFAULT" else...

WordPress SigmaForms Pro plugin <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field vulnerability

Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field vulnerability discovered by Doan Dinh Van in WordPress Plugin SigmaForms Pro – AI Generated Forms versions = 1.4.11...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to deletion of properties (CVE-2025-13465)

Summary Undici is used by IBM Storage Fusion Data Foundation in components odf-console, noobaa-core. This bulletin identifies the steps to take to address the vulnerability in IBM Storage Fusion Data Foundation. CVE-2025-13465 Vulnerability Details CVEID:CVE-2025-13465 DESCRIPTION: Lodash version...

WordPress WP File Download plugin <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter vulnerability

Authenticated Subscriber+ Arbitrary File Deletion via 'remoteurl' Parameter vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin WP File Download versions = 6.3.4...

CVE-2026-66751-Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat-

安全公告：访问控制不足导致未授权删除房间（Let's Chat） 分配的 CVE 编号： CVE-2026-66751 摘要 DELETE /rooms/:room 除了要求登录之外，不执行任何授权检查。任何账户都可以归档服务器上的任意房间，包括该账户无权读取、加入或修改的私有房间和密码保护房间。 归档就是 Let's Chat 删除房间的方式。房间会从房间列表中消失，直接查找返回 404，向其发布消息或上传文件也会被拒绝。应用程序中没有任何代码路径可以撤销此操作。 受影响版本 仓库 URL：https://github.com/sdelements/lets-chat 从 0.3.0（...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...

CVE-2026-83595

AVideo contains a Cross-Site Request Forgery (CSRF) vulnerability in the plugin/API/set.json.php component. The flaw allows attackers to craft GET requests that bypass CSRF protection, performing state-changing actions on a victim's session without user consent. Concretely, a victim can be naviga...

CVE-2026-83595 AVideo Cross-Site Request Forgery via plugin/API/set.json.php

AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos,...

Telesquare TLR-2855KS6 - Arbitrary File Deletion

An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts. id: CVE-2021-46419 info: name: Telesquare TLR-2855KS6 - Arbitrary File Deletion author: DhiyaneshDK severity: critical description: | An unauthorized file deleti...

CVE-2023-26563-26564-26565

ベンダーは、2024年以降のリリースで詳細に記載されたすべての脆弱性を修正したと報告しています。Ruptura InfoSecurityはこれらの修正が完全であることを確認していません。 ベンダーのコメントは https://github.com/RupturaInfoSec/CVE-2023-26563-26564-26565/issues/1 を参照してください。 CVE-2023-26563 - ASPCore Filemanager におけるローカルファイル読み取り 影響を受けるリポジトリ:...

CVE-2024-10470

CVE-2024-10470 WPLMS Learning Management System for WordPress = 4.962 – 認証なしの任意ファイル読み取り・削除 説明 WordPress用のWPLMS Learning Management System（WordPress...

cve-2019-14206-poc

CVE-2019-14206 - WordPress自适应图片任意文件删除 📋 目录 1. 关于漏洞 2. 前提条件 3. 安装 4. 测试方法 快速测试 完整Docker测试 使用Nuclei测试 手动测试 5. 结果解读 6. 清理 7. 故障排除 8. 缓解措施 9. 法律声明 🎯 关于漏洞 CVE-ID: CVE-2019-14206 严重性: 高危 CVSS 6.5 受影响插件: WordPress自适应图片 受影响版本: /dev/null || echo "PHP不可用（可选）" 🚀 安装 步骤1：克隆或下载文件 root@kitploit:...

Seecret.it

📦 Seecret.it — 通过一次性链接安全分享 Seecret.it 是一个在线服务，允许通过加密的一次性链接共享密码、文档或敏感信息。您的数据保持不可见、安全，并在查看后自动销毁。非常适合 IT 团队、企业、自由职业者以及任何希望保密传输信息的人。 🔐 主要功能 服务器端加密和读取后自动删除 一次性或自定义时效链接 安全共享密码、笔记、消息或文件 可选的二级密码保护 访问统计（日期、IP、浏览器、国家——如果启用） 专用页面生成 Wi-Fi 二维码 内置密码生成器 简单的 API，可发送文本并获取唯一链接 正在开发的扩展和工具（Thunderbird、浏览器等） 🚀 为什么使用...

CVE-2026-19952

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the movefolders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the...

CVE-2025-62950-PoC

描述 本概念验证（PoC）描述了在 Contest Gallery – Upload, Vote & Sell with PayPal and Stripe v. 26.1.2 插件中发现的一个跨站请求伪造（CSRF）漏洞。该问题允许攻击者诱骗已认证用户执行精心构造的请求，从而在用户不知情的情况下删除图库项目，导致未经授权的内容丢失，影响数据完整性。 详情 漏洞类型 ：跨站请求伪造（CSRF） 受影响插件 ： 影响 攻击者可在用户不知情或未明确许可的情况下触发非预期操作，尤其是删除图库项目。成功利用该漏洞可能导致未经授权的内容删除，威胁系统内的数据完整性。 参考 WPScan...

CVE-2026-19952

The Frontend Admin by DynamiApps WordPress plugin (versions ≤ 3.29.12 ) is vulnerable to unauthenticated arbitrary file deletion caused by insufficient file path validation in the move_folders function, specifically via the custom_directory_name Merge Tag. Discovered by nudien , the flaw allows a...

CVE-2026-19952 Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the movefolders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the...

EUVD-2026-68973

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the movefolders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the...