CVE-2026-12277

CVE-2026-12277 Frontend File Manager Plugin WordPress = 23.6 - Unauthenticated Arbitrary File Deletion to RCE Summary...

CVE-2026-8713

CVE-2026-8713 — Avada Fusion Builder WordPress Exploit Pre-Auth Path Traversal → Arbitrary File Delete → Force Reinstall → RCE Overview CVE-2026-8713 is a CVSS 9.1 critical vulnerability in the Avada Fusion Builder plugin/theme for WordPress. The maybedeletefiles function in the FusionFormDBEntri...

BitLock-Crypto-Research

🛡️ BitLock Framework: Ecosistema de Criptovirología y C2 PoC Este repositorio contiene una Prueba de Concepto PoC integral diseñada para el estudio de arquitecturas de amenazas modernas. El proyecto simula un entorno de ataque fileless sin archivos con una infraestructura de comando y control C2...

CVE-2025-60710

CVE-2025-60710 This is PoC for local privilege escalation vulnerability in \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration scheduled task. When this scheduled task is started the taskhostw.exe process whill try to open the C:\Users%username%\AppData\Local\CoreAIPlatform.00\UKP directory...

CVE-2026-75458

CVE-2026-75458 is a vertical privilege escalation in the XueZhiSi Open Source Exam System (versions ≤ 3.9.0). The teacher-end endpoint POST /api/teacher/user/delete/{id} deletes the target user after calling getUserById(id), setDeleted(true), and updateByIdFilter() without verifying whether the r...

CVE-2026-51729

CVE-2026-51729 affects the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). The root cause is an incorrect access control in the delDevice function, reachable via a crafted POST request to /cgi-bin/cstecgi.cgi , which allows an unauthenticated attacker to request deletion of a managed slave ...

EUVD-2026-68881

The teacher-end interface POST /api/teacher/user/delete/id in XueZhiSi Open Source Exam System = 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserByIdid, setDeletedtrue, updateByIdFilter in sequence, without any validation of...

CVE-2026-75458

The teacher-end interface POST /api/teacher/user/delete/id in XueZhiSi Open Source Exam System = 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserByIdid, setDeletedtrue, updateByIdFilter in sequence, without any validation of...

CVE-2026-51729

Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to request deletion of a managed slave device via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2025-65669

CVE-2025-65669 An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only deletion restriction. Discovered by - Rivek Raj Tamang RivuDon, Sikkim, India...

CVE-2025-48799

Description This is PoC for CVE-2025-48799, an elevation of privilege vulnerability in Windows Update service. This vulnability affects windows clients win11/win10 with at least 2 hard drives. When machine have multiple hard drives it is possible to change location where new content is saved usin...

Raccine

Raccine A Simple Ransomware Protection Why We see ransomware delete all shadow copies using vssadmin pretty often. What if we could just intercept that request and kill the invoking process? Let's try to create a simple vaccine. How it works We register a debugger for vssadmin.exe and wmic.exe,...

CVE-2026-12513

CVE-2026-12513: Shared Files 1.7.68 — Unauthenticated Arbitrary File Deletion via Path Traversal 📖 Advisory Overview CVE-2026-12513 is an unauthenticated Arbitrary File Deletion vulnerability via Path Traversal affecting the Shared Files and Shared Files Pro WordPress plugins before version 1.7.6...

CVE-2020-26259

Description XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights. Influence Xstream \n" + " \n" + " \n" + " 0\n" + " \n" + " \n" + " \n" + " text/plain\n" + " \n" + " C:\Al1ex.txt\n" + " \n" + " \n" + " \n"...

Exploit for CVE-2026-12513

CVE-2026-12513: Shared Files Quick Links: Explore the res...

CVE-2026-0603

CVE-2026-0603 Hibernate ORM Injection / Second-Order SQL Injection ★ CVE-2026-0603 Hibernate SQL Injection PoC ★ https://github.com/user-attachments/assets/2e7c3a89-e26f-48cd-af0b-8b82d32ce71f Overview CVE-2026-0603 is a Second-Order SQL Injection vulnerability in Hibernate ORM , a widely used Ja...

CVE-2026-24135

CVE-2026-24135: Beliebige Dateilöschung in Gogs durch Wiki-Pfad-Traversal Schweregrad: Hoch CVSS 7.5 Betroffene Software: Gogs Behoben in: 0.13.4, 0.14.0+dev Advisory: GHSA-jp7c-wj6q-3qf2 Patch: gogs/gogs8099 Zusammenfassung Während eines Sicherheits-Audits von Gogs einem beliebten, in Go...

WiseDelete

Wrapper del Driver WiseDelfile Un'utilità Windows leggera che carica il driver kernel WiseDelfile64.sys , esegue l'handshake del dispositivo richiesto e invia richieste IOCTL per eliminare file che non possono essere rimossi tramite le API Windows standard. Questo progetto dimostra come...

CVE-2026-48866

php // deletephysicalfile — WITH validation $filepath = self::getphysicalfilepath $url, $entryid ; $filepath = applyfilters 'gformfilepathpredeletefile', $filepath, $url ; // NEW: verify path is in uploads if ! GFCommon::isfileinuploads$url GFCommon::logdebugMETHOD . sprintf': Not del...

CVE-2023-6972-Exploit-Arbitrary-File-Deletion

CVE-2023-6972 Dimostrazione di concetto PoC Descrizione Questo repository contiene un exploit Proof of Concept PoC per CVE-2023-6972. La vulnerabilità consente la cancellazione arbitraria di file non autenticata AFD nel plugin Wordpress Backup Migration Nota: Un'analisi tecnica completa, un caso ...