EUVD-2020-7244

Malware in sbrugna...

EUVD-2025-28234

Malicious code in bioql PyPI...

EUVD-2025-16452

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2020-15175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In GLPI before version 9.5.2, the pluginimage.send.php endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to...

CVE-2025-48480

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an authorized user with the administrator role or with the privilege User::PERMEDITUSERS can create a user, specifying the path to the user's avatar ../.htaccess during creation, and then delete the user's...

PT-2025-23246 · Freescout · Freescout

Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.180 Description: The issue allows an authorized user with the administrator role or the privilege User::PERM EDIT USERS to create a user and specify the path to the user's avatar as ../.htaccess during creation...

Private Files <= 0.40 - Protection Disabling via CSRF

The plugin is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perform such action via a CSRF attack and make the blog public PoC That will also delete the .htaccess...

CVE-2022-24248

RiteCMS version 3.1.0 and below suffers from an arbitrary file deletion via path traversal vulnerability in Admin Panel. Exploiting the vulnerability allows an authenticated attacker to delete any file in the web root along with any other file on the server that the PHP process user has the prope...

UBUNTU-CVE-2020-15175

In GLPI before version 9.5.2, the ​pluginimage.send.php​ endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in “/files/”...

PT-2020-14248 · Teclib +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 9.5.2 Description: The issue allows a user to specify an image from a plugin through the "pluginimage.send.php" endpoint. The parameters can be maliciously crafted to delete the .htaccess file for the files directory,...