CVE-2026-82665

yaojingang GEOFlow (up to 2.1.0) contains a path traversal vulnerability in the Image Library Cleanup component. The flaw resides in the unlink function of app/Http/Controllers/Admin/ImageLibraryController.php, where an attacker who controls the file_path argument can delete files outside the int...

CVE-2026-82665 yaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal

A vulnerability was detected in yaojingang GEOFlow up to 2.1.0. This vulnerability affects the function unlink of the file app/Http/Controllers/Admin/ImageLibraryController.php of the component Image Library Cleanup. The manipulation of the argument filepath results in path traversal. The attack...

CVE-2026-82599

A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. Th...

CVE-2026-82599 SeaCMS Avatar Upload member.php unlink path traversal

A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. Th...

CVE-2026-82599

SeaCMS versions up to 13.6 are affected by a path traversal vulnerability in the Avatar Upload component. The flaw resides in the unlink function of /member.php?action=chgpwdsubmit, where manipulation of the oldpic argument allows a remote attacker with low privileges to delete arbitrary files. T...

EUVD-2026-68302

A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. Th...

EUVD-2026-65177

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...

CVE-2026-78435

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...

CVE-2026-78435 Faveo Helpdesk Logo SettingsController.php unlink path traversal

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...

CVE-2026-78435

A path traversal vulnerability exists in Faveo Helpdesk up to version 2.0.3 . The flaw is in the unlink function within app/Http/Controllers/Admin/helpdesk/SettingsController.php (component: Logo Handler ). Manipulation of the data1 argument allows an authenticated attacker (high privileges requi...

EUVD-2026-56043

A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink without sanitization or path...

PT-2026-70148

Name of the Vulnerable Software and Affected Versions Intelliants Subrion CMS versions prior to 4.2.2 Description An authenticated administrator can delete arbitrary files on the server through the admin panel file deletion endpoint. This occurs because the endpoint passes a user-supplied file pa...

EUVD-2026-52424

A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /system/htmly.php of the component Delete Username Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit is...

EUVD-2022-29522

Malicious code in bioql PyPI...

CVE-2025-8433

A vulnerability was found in code-projects Document Management System 1.0 and classified as critical. This issue affects the function unlink of the file /dell.php. The manipulation of the argument ID leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to...

CVE-2025-8433 code-projects Document Management System dell.php unlink path traversal

A vulnerability was found in code-projects Document Management System 1.0 and classified as critical. This issue affects the function unlink of the file /dell.php. The manipulation of the argument ID leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to...

CVE-2021-37144

CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. This occurs in PHP when the unlink function is called and user input might affect portions of or the whole affected parameter, which represents the path of the file to remove, without sufficient sanitization...

PT-2025-21866 · Sourcecodester · Sourcecodester Student Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Student Result Management System version 1.0 Description: A critical issue has been identified, affecting the unlink function of the update system.php file in the Logo File Handler component. The manipulation of the old logo...

WordPress plugin WPLMS Learning Management System 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

Remote Code Execution Vulnerability Through Unrestrict File Write

Description In the import setting function, in the file Froxlor\lib\Froxlor\SImExporter.php php fileputcontents$imgfilename, $imgdata; if functionexists'finfoopen' $finfo = finfoopenFILEINFOMIMETYPE; $mimetype = finfofile$finfo, $imgfilename; finfoclose$finfo; else $mimetype =...