87 matches found
OneNav v0.9.35-20240318 - Server-Side Request Forgery (SSRF)
OneNav v0.9.35-20240318 is vulnerable to server-side request forgery SSRF via the url parameter in the getlinkinfo API. An attacker can force the server to make arbitrary requests, potentially accessing internal resources. id: CVE-2024-33832 info: name: OneNav v0.9.35-20240318 - Server-Side Reque...
CVE-2026-88621
OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory. The application passes the user-controll...
CVE-2026-88621: Use of Incorrectly-Resolved Name or Reference
OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory. The application passes the user-controll...
CVE-2026-88621
OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory. The application passes the user-controll...
CVE-2026-88621
OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability within the Api::upload() method in class/Api.php. An authenticated administrator can trigger this by submitting a non-HTML upload filename that matches an existing file in the application's working directory. The root c...
EUVD-2026-78864
OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory. The application passes the user-controll...
PT-2026-92116
Name of the Vulnerable Software and Affected Versions OneNav version 1.2.4 Description An authenticated administrator can trigger an arbitrary file deletion by submitting a non-HTML upload filename that matches an existing file in the application's working directory. This occurs within the...
CVE-2026-88621
OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory. The application passes the user-controll...
CVE-2026-75464
OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via importlink...
CVE-2026-75464
OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via importlink...
CVE-2026-75464
OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via importlink...
EUVD-2026-65146
OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via importlink...
PT-2026-81034
Name of the Vulnerable Software and Affected Versions OneNav version 1.2.4 Description An authenticated user can perform arbitrary file deletion through the import link function. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerabilit...
CVE-2026-75464: Files or Directories Accessible to External Parties
OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via importlink...
CVE-2026-75464
OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via importlink...
CVE-2026-75464
OneNav version 1.2.4 contains an authenticated arbitrary file deletion vulnerability. The flaw is located within the import_link() function, allowing an authenticated user to delete files or directories. This vulnerability has a HIGH base severity (CVSS 3.1 score of 8.1) and can impact integrity ...
CVE-2022-26276
An issue in index.php of OneNav v0.9.14 allows attackers to perform directory traversal...
EUVD-2021-24611
Malware in sbrugna...