38 matches found
PT-2026-92116
Name of the Vulnerable Software and Affected Versions OneNav version 1.2.4 Description An authenticated administrator can trigger an arbitrary file deletion by submitting a non-HTML upload filename that matches an existing file in the application's working directory. This occurs within the...
CVE-2026-82665
yaojingang GEOFlow (up to 2.1.0) contains a path traversal vulnerability in the Image Library Cleanup component. The flaw resides in the unlink function of app/Http/Controllers/Admin/ImageLibraryController.php, where an attacker who controls the file_path argument can delete files outside the int...
CVE-2026-82665 yaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal
A vulnerability was detected in yaojingang GEOFlow up to 2.1.0. This vulnerability affects the function unlink of the file app/Http/Controllers/Admin/ImageLibraryController.php of the component Image Library Cleanup. The manipulation of the argument filepath results in path traversal. The attack...
CVE-2026-82599
A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. Th...
CVE-2026-82599 SeaCMS Avatar Upload member.php unlink path traversal
A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. Th...
CVE-2026-82599 SeaCMS Avatar Upload member.php unlink path traversal
A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. Th...
CVE-2026-82599
SeaCMS versions up to 13.6 are affected by a path traversal vulnerability in the Avatar Upload component. The flaw resides in the unlink function of /member.php?action=chgpwdsubmit, where manipulation of the oldpic argument allows a remote attacker with low privileges to delete arbitrary files. T...
EUVD-2026-68302
A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. Th...
PT-2026-83721
A vulnerability was detected in yaojingang GEOFlow up to 2.1.0. This vulnerability affects the function unlink of the file app/Http/Controllers/Admin/ImageLibraryController.php of the component Image Library Cleanup. The manipulation of the argument file path results in path traversal. The attack...
PT-2026-83647
A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. Th...
EUVD-2026-65177
A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...
CVE-2026-78435
A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...
CVE-2026-78435 Faveo Helpdesk Logo SettingsController.php unlink path traversal
A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...
CVE-2026-78435 Faveo Helpdesk Logo SettingsController.php unlink path traversal
A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...
CVE-2026-78435
A path traversal vulnerability exists in Faveo Helpdesk up to version 2.0.3 . The flaw is in the unlink function within app/Http/Controllers/Admin/helpdesk/SettingsController.php (component: Logo Handler ). Manipulation of the data1 argument allows an authenticated attacker (high privileges requi...
PT-2026-81066
A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...
EUVD-2026-56043
A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink without sanitization or path...
PT-2026-70148
Name of the Vulnerable Software and Affected Versions Intelliants Subrion CMS versions prior to 4.2.2 Description An authenticated administrator can delete arbitrary files on the server through the admin panel file deletion endpoint. This occurs because the endpoint passes a user-supplied file pa...
EUVD-2026-52424
A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /system/htmly.php of the component Delete Username Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit is...