GHSA-6VFX-W7Q3-42GQ AdminNeo SQLite Database-List Drop Arbitrary File Deletion

Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted db values direct...

AdminNeo SQLite Database-List Drop Arbitrary File Deletion

Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted db values direct...

duplicate-CVE-2025-4720-

cve-srms-drop-student-path-traversal CVE-2025-4720dupe Arbitrary File Deletion in SourceCodester SRMS 1.0 Description A path traversal vulnerability exists in the dropstudent.php endpoint of SourceCodester Student Result Management System SRMS 1.0. The application takes user-controlled input from...

filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold

StrictSoftFileLock and AsyncStrictSoftFileLock apply the caller's mode to the sentinel the lock file at and to both claim files the files whose presence says a process wants or holds the lock. They create the two directories that hold the claims, .filelock and .filelock/claims, with a bare mkdir...

SUSE CVE-2026-98984

In the Linux kernel, the following vulnerability has been resolved: dcache: don't put a mountpoint on a dentry that's being removed rmdir, unlink and rename call dontmount on the victim and then detachmounts with the victim's inode locked. dolockmount takes the inode lock of the mountpoint and...

EUVD-2026-110507

A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink of the file admin/delete.php. Performing a manipulation of the argument imagename results in path traversal. The attack is possible to be carried out remotely. The exploit is now...

CVE-2026-116602

A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink of the file admin/delete.php. Performing a manipulation of the argument imagename results in path traversal. The attack is possible to be carried out remotely. The exploit is now...

CVE-2026-116602 SourceCodester Online Food Ordering System delete.php unlink path traversal

A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink of the file admin/delete.php. Performing a manipulation of the argument imagename results in path traversal. The attack is possible to be carried out remotely. The exploit is now...

CVE-2026-116602

A path traversal vulnerability exists in SourceCodester Online Food Ordering System 1.0 . The issue is located within the unlink function of the admin/delete.php file, where manipulation of the image_name argument allows for remote path traversal. The impact includes potential unauthorized file d...

PT-2026-125504

A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink of the file admin/delete.php. Performing a manipulation of the argument image name results in path traversal. The attack is possible to be carried out remotely. The exploit is no...

GHSA-V4X8-3WR5-3WQ8 filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock hand SQLite a name they do not control. On Linux the lock validates its database through a descriptor the number the kernel gives a process for an open file. It then connects SQLite to /proc/self/fd/, a Linux path that name...

EUVD-2026-105031

filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files...

DEBIAN-CVE-2026-98984

In the Linux kernel, the following vulnerability has been resolved: dcache: don't put a mountpoint on a dentry that's being removed rmdir, unlink and rename call dontmount on the victim and then detachmounts with the victim's inode locked. dolockmount takes the inode lock of the mountpoint and...

CVE-2026-98984

In the Linux kernel, the following vulnerability has been resolved: dcache: don't put a mountpoint on a dentry that's being removed rmdir, unlink and rename call dontmount on the victim and then detachmounts with the victim's inode locked. dolockmount takes the inode lock of the mountpoint and...

CVE-2026-98984

In the Linux kernel, the following vulnerability has been resolved: dcache: don't put a mountpoint on a dentry that's being removed rmdir, unlink and rename call dontmount on the victim and then detachmounts with the victim's inode locked. dolockmount takes the inode lock of the mountpoint and...

CVE-2026-98984 dcache: don't put a mountpoint on a dentry that's being removed

In the Linux kernel, the following vulnerability has been resolved: dcache: don't put a mountpoint on a dentry that's being removed rmdir, unlink and rename call dontmount on the victim and then detachmounts with the victim's inode locked. dolockmount takes the inode lock of the mountpoint and...

CVE-2026-98984 dcache: don't put a mountpoint on a dentry that's being removed

In the Linux kernel, the following vulnerability has been resolved: dcache: don't put a mountpoint on a dentry that's being removed rmdir, unlink and rename call dontmount on the victim and then detachmounts with the victim's inode locked. dolockmount takes the inode lock of the mountpoint and...

CVE-2026-98984

The Linux kernel contains a vulnerability where a mountpoint can become orphaned on a dentry that is being removed during rmdir() , unlink() , or rename() operations. The root cause involves a race condition where attach_recursive_mnt() creates a second mountpoint without locking the inode, allow...

EUVD-2026-108778

In the Linux kernel, the following vulnerability has been resolved: dcache: don't put a mountpoint on a dentry that's being removed rmdir, unlink and rename call dontmount on the victim and then detachmounts with the victim's inode locked. dolockmount takes the inode lock of the mountpoint and...

CVE-2026-98981

The Linux kernel is vulnerable to a race condition where a dentry remains hashed and positive between the detach_mounts() and d_delete() calls during unlink(), rmdir(), or rename() operations. This allows a lookup to find the dentry in the dcache and potentially uncover data hidden by the mounts,...