219 matches found
CVE-2025-11072 Download Counter Button <= 1.8.6.7 - Unauthenticated Arbitrary File Download
The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files...
PT-2025-44568
Name of the Vulnerable Software and Affected Versions Netgate pfSense CE Suricata affected versions not specified Description This issue allows remote attackers to create arbitrary files on affected installations. Authentication is required for exploitation. The flaw is due to insufficient...
CVE-2025-10916 FormGent < 1.0.4 - Unauthenticated Arbitrary File Deletion
The FormGent WordPress plugin before 1.0.4 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it possible for unauthenticated attackers to delete arbitrary files on the server...
CVE-2025-6439
The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'wcdpsavecanvasdesignajax' function in all versions up to, and including, 1.9.26. Th...
CVE-2025-6439
The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'wcdpsavecanvasdesignajax' function in all versions up to, and including, 1.9.26. Th...
CVE-2025-6439
The CVE-2025-6439 case concerns the WooCommerce Designer Pro plugin for WordPress (used with Pricom theme). The vulnerability is an unauthenticated arbitrary file deletion due to insufficient file path validation in the wcdp_save_canvas_design_ajax function, affecting versions up to 1.9.26. Conne...
CVE-2025-7526 WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to arbitrary file deletion via renaming due to insufficient file path validation in the setuserprofileimage function in all versions up to, and including, 6.6.7. This makes it possible for...
CVE-2025-10494
CVE-2025-10494 affects the Motors – Car Dealership & Classified Listings Plugin for WordPress (versions up to 1.4.89). The root cause is insufficient validation of file paths when deleting profile pictures, allowing an authenticated attacker with Subscriber-level access or higher to delete arbitr...
WordPress plugin Motors – Car Dealership & Classified Listings 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. A security...
EUVD-2019-6022
Malware in sbrugna...
EUVD-2023-43183
Malicious code in bioql PyPI...
EUVD-2025-31222
Malicious code in bioql PyPI...
EUVD-2025-27643
Malicious code in bioql PyPI...
EUVD-2025-25002
Malicious code in bioql PyPI...
EUVD-2025-23572
Malicious code in bioql PyPI...
CVE-2025-10307
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete backup functionality in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with...
PT-2025-39517
Name of the Vulnerable Software and Affected Versions Backuply – Backup, Restore, Migrate and Clone plugin for WordPress versions through 1.4.8 Description The Backuply plugin for WordPress is susceptible to arbitrary file deletion because of inadequate file path validation within the delete back...
CVE-2025-10058
Mode C: The WP Import – Ultimate CSV XML Importer for WordPress plugin is affected (versions
CVE-2025-8575
The LWS Cleaner plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'lwscldeletefile' function in all versions up to, and including, 2.4.1.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to...
PT-2025-37289
Name of the Vulnerable Software and Affected Versions: LWS Cleaner plugin for WordPress versions up to and including 2.4.1.3 Description: The LWS Cleaner plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation within the lws cl delete file function...