CVE-2025-62950-PoC

説明 この概念実証（PoC）は、Contest Gallery – Upload, Vote & Sell with PayPal and Stripe v. 26.1.2 プラグインで発見されたクロスサイトリクエストフォージェリ（CSRF）脆弱性について説明しています。この問題により、攻撃者は認証済みユーザーを騙して、ユーザーの同意なしにギャラリー項目を意図せず削除する細工されたリクエストを実行させ、不正なコンテンツ損失を引き起こし、データ整合性に影響を与える可能性があります。 詳細 脆弱性タイプ : クロスサイトリクエストフォージェリ（CSRF） 影響を受けるプラグイン : 影響...

CVE-2026-19952

The Frontend Admin by DynamiApps WordPress plugin (versions ≤ 3.29.12 ) is vulnerable to unauthenticated arbitrary file deletion caused by insufficient file path validation in the move_folders function, specifically via the custom_directory_name Merge Tag. Discovered by nudien , the flaw allows a...

EUVD-2026-68973

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the movefolders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the...

CVE-2026-19952 Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the movefolders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the...

CVE-2026-75458

The teacher-end interface POST /api/teacher/user/delete/id in XueZhiSi Open Source Exam System = 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserByIdid, setDeletedtrue, updateByIdFilter in sequence, without any validation of...

CVE-2026-75594

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache...

CVE-2026-79743

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...

EUVD-2026-68691

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...

gitlab-cve-2026-19478-lab

CVE-2026-19478 — GitLab GraphQL @glintroduced 未認証の任意メソッド呼び出し（検証ラボ + PoC） CVE-2026-19478 （GitLab CE/EE、CVSS 9.4、Critical）向けの再現可能なA/Bラボおよび安全なPoCです。 未認証の 攻撃者が、GraphQLで解決されたドメインオブジェクト上の任意の0引数Rubyメソッドを呼び出せます。 例：Projectdestroy を呼び出して、認証情報なしで公開プロジェクトを削除 することができます。 同じリリースで修正された関連脆弱性 CVE-2026-19650...

CVE-2022-38604

CVE-2022-38604 のエクスプロイト FilesystemEoPs は、このリポジトリのコピーで、x64 コンパイル済みプロジェクトが追加されています。 こちらで、任意ファイル削除の脆弱性 に関する私のレポートをご覧いただけます。 こちらで、任意ファイル削除 プリミティブを使用してローカル権限昇格 を達成する方法を理解できます。 こちらで、任意ファイル削除 プリミティブを使用してWindows サービス拒否 を達成する方法を理解できます。 こちらで私にユニコーンを買うことができます 🦄 知識を共有しましょう！...

WordPress Frontend Admin by DynamiApps plugin <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag vulnerability

Unauthenticated Arbitrary File Deletion via Path Traversal via customdirectoryname Merge Tag vulnerability discovered by nudien in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.12...

CVE-2026-78075

Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate 2.2.10 - Blog::removeimage checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path src belonged to that...

CVE-2026-78075 Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10

Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate 2.2.10 - Blog::removeimage checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path src belonged to that...

CVE-2026-78075 Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10

Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate 2.2.10 - Blog::removeimage checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path src belonged to that...

CVE-2026-78075

Helix Ultimate is a Joomla extension by joomshaper.com. Versions prior to 2.2.10 contain a Broken Object-Level Authorization flaw in the Blog::remove_image() function. The function verified that the user was authorized to edit the article ID supplied in the request, but did not confirm that the s...

EUVD-2026-68529

Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate 2.2.10 - Blog::removeimage checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path src belonged to that...

EUVD-2026-68522

Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected...

CVE-2026-78074 Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions

Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected...

Gitlab-CVE-2026-19478

CVE-2026-19478 — GitLab GraphQL @glintroduced ディレクティブインジェクション GitLab CE/EE の GraphQL ディレクティブを介した未認証リモートコードインジェクション — 単一の HTTP リクエストで任意の公開プロジェクトを削除 CVE-2026-19478 を再現する実践型ペネトレーションテストラボです。これは GitLab の GraphQL API における重大な（CVSS 9.4）脆弱性です。@glintroduced ディレクティブにより、認証されていない攻撃者がサーバーサイドオブジェクト上で任意の Ruby...

CVE-2023-27470_Exercise

CVE-2023-27470 通过任意文件删除实现权限提升的练习 本仓库包含一个本地权限提升练习，模拟 CVE-2023-27470。你的任务，如果你选择接受的话，是找到漏洞并获取 SYSTEM 命令提示符！如果你想直接跳到解决方案，请查看 solution.txt。在 Deleting Your Way Into SYSTEM: Why Arbitrary File Deletion Vulnerabilities Matter 中了解更多关于任意文件删除漏洞及其风险的信息。 作者：Andrew Oliveau @AndrewOliveau 练习设置说明 1. 使用配置了 2...