CVE-2026-15232

The MotoPress Appointment Booking WordPress plugin before 2.4.8 lacks an authorization or ownership check when processing a user-supplied booking identifier on an unauthenticated endpoint , allowing attackers to permanently delete other users' reservations. This is an incomplete fix of CVE-2026-9...

CVE-2026-15232 Appointment Booking Lite < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...

EUVD-2026-69872

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesubmissionfiles function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitra...

CVE-2026-78657

The SigmaForms Pro – AI Generated Forms WordPress plugin (versions ≤ 1.4.11) is affected by an unauthenticated arbitrary file deletion vulnerability rooted in insufficient file path validation in the delete_submission_files function. An attacker submits a malicious path traversal URL via the plug...

CVE-2026-78657 SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesubmissionfiles function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitra...

CVE-2023-26563-26564-26565

供应商声称在2024年之后发布的所有版本中已修复所有详细列出的漏洞。Ruptura InfoSecurity 尚未验证这些修复是否完整。 请参阅供应商在 https://github.com/RupturaInfoSec/CVE-2023-26563-26564-26565/issues/1 中的评论。 CVE-2023-26563 - ASPCore Filemanager 中的本地文件读取 受影响的仓库：https://github.com/SyncfusionExamples/ej2-aspcore-file-provider/ Git 提交...

CVE-2023-27470_Exercise

CVE-2023-27470 EoP（権限昇格）による Arbirary File Deletion 演習 このリポジトリには、CVE-2023-27470 を再現したローカル権限昇格の演習が含まれています。あなたのミッション（もし受け入れるなら）は、脆弱性を見つけて SYSTEM のコマンドプロンプトを取得することです！解答に飛びたい場合は、solution.txt を参照してください。任意ファイル削除の脆弱性とそのリスクについて詳しくは、SYSTEMへの道：任意ファイル削除の脆弱性が重要な理由 をご覧ください。 著者: Andrew Oliveau @AndrewOliveau...

CVE-2025-63945-Tencent-iOA-EoP

CVE-2025-63945 Tencent iOA 权限提升 版本：210.9.28693.62001 之前 摘要：我发现腾讯电脑管家存在一个漏洞，其中 C:\Windows\Temp 下的文件和目录处理不安全。攻击者可以利用符号链接（symlink）攻击，强制一个 SYSTEM 权限的进程删除任意文件，从而导致本地权限提升。具体来说，当使用“ioa”组件时，会定期启动一个名为 LegacyKBioawin.exe 的进程。在运行过程中，它会在 Temp 文件夹下创建 TencentDownload 目录，将文件下载至该目录中，然后以 SYSTEM...

CVE-2025-63298

CVE-2025-63298 Se identificó una vulnerabilidad de path traversal en SourceCodester Pet Grooming Management System 1.0, que afecta al componente admin/managewebsite.php. Un usuario autenticado con privilegios administrativos puede aprovechar esta falla enviando una solicitud POST especialmente...

CVE-2026-14982

The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server,...

CVE-2024-27460

CVE-2024-27460 - Plantronics Desktop Hub LPE 任意文件删除至SYSTEM。大部分代码基于@filipdragovic引用的PoC。感谢@filipdragovic & @k0zmer : 博客文章：https://mantodeasecurity.de/en/2024/05/cve-2024-27460-plantronics-hub-lpe 参考资料 https://support.hp.com/us-en/document/ish9869257-9869285-16/hpsbpy03895...

EUVD-2026-69821

The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server,...

CVE-2026-14982

The WP File Download plugin for WordPress (versions ≤ 6.3.4 ) is vulnerable to arbitrary file deletion via insufficient path validation in the delete function. Authenticated attackers with subscriber-level access or above can exploit a two-stage attack : first calling the file.save endpoint to pe...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Syst...

EUVD-2026-69720

WWBN AVideo contains a path traversal vulnerability in the API getapilogincode endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplying directory traversal sequences in the code parameter. Attackers can exploit this to destroy audit logs and probe for file...

PT-2026-84733

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description A path traversal flaw exists in the Kibana Fleet feature. A low-privileged user with write access to Fleet Settings can manipulate pathnames to target restricted directories. This allows the...

CVE-2020-3187

CVE-2020-3187 curl -H "Cookie: token=. ./+CSOU+/cscologo.gif" https://target.com/+CSCOE+/sessionpassword.html logo.gif 会被删除...

LockingGirl-----CVE-2022-0847-Dirty_Pipe_virus

DirtyPipevirus Dirty Pipe 是一种 Linux 漏洞利用方式，其 CVE 编号为 CVE 2022-0847。 我们用它来删除你 Ubuntu 上的所有文件。 环境： Ubuntu 20.04 Linux 内核 5.8 以下是 Ubuntu 20.04 的 ova 文件：https://ttuedutw-my.sharepoint.com/:u:/g/personal/410806228o365ttuedutw/EWPK1npa-V5EhebEOrwhocBMaKH12xVcIdtdkxxU3UFNg?e=clKIbQ 密码：ShaoLei0518 编译漏洞利用程...

CVE-2023-20198

CVE-2023-20198 - PoC SCRIPT /!\ 免责声明： 此脚本按“原样”提供，仅用于教育目的。强烈建议用户谨慎使用，并在法律和道德允许的范围内使用。 描述 在目标 Web 服务器上执行各种操作，例如创建和/或删除本地用户帐户、重启 Web 服务器、安装并检查植入物是否存在，最后清理所创建的用户帐户。 要求 Python 3.x Requests 库（pip install requests） 用法 root@kitploit: python CVECISCO20198V2.py 关于...

CVE-2022-31814

Download CVE-2022-31814 该脚本利用 pfSense 中的一个漏洞来上传一个 shell、执行命令，然后删除 shell。 要求 Python 3.x requests 库 安装 1. 克隆仓库或下载脚本。 2. 安装所需的 Python 库： root@kitploit: pip install requests 使用 root@kitploit: python pfsense.py -f -c -f, --file：包含 URL 列表的文件路径（每行一个）。 -c, --command：要在目标上执行的命令。 示例 root@kitploit: python...