EUVD-2019-1896

Malware in sbrugna...

Arbitrary file deletion

BaiCloud-cms v2.5.7 is affected by an arbitrary file deletion vulnerability, which allows an attacker to delete arbitrary files on the server through /user/ppsave.php...

CVE-2021-41729

BaiCloud-cms v2.5.7 is affected by an arbitrary file deletion vulnerability, which allows an attacker to delete arbitrary files on the server through /user/ppsave.php...

PT-2021-23385

Name of the Vulnerable Software and Affected Versions BaiCloud-cms version 2.5.7 Description The issue allows an attacker to delete arbitrary files on the server through the "/user/ppsave.php" API endpoint. This is an arbitrary file deletion vulnerability. Recommendations For BaiCloud-cms version...

CVE-2021-41729: Missing Authorization

BaiCloud-cms v2.5.7 is affected by an arbitrary file deletion vulnerability, which allows an attacker to delete arbitrary files on the server through /user/ppsave.php...

CVE-2019-1010151

CVE-2019-1010151 affects zzcms zzmcms ≤ 8.3. The vulnerability is in the /user/ppsave.php component, described as “File Delete to getshell,” with the impact being getshell. NVD lists CVSS v3.0 base score 9.8 (CRITICAL) and CVSS v2.0 base score 7.5 (HIGH); attack vector is network, no authenticati...

CVE-2019-1010151

zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell. The impact is: getshell. The component is: /user/ppsave.php...

PT-2019-11482

Name of the Vulnerable Software and Affected Versions: zzcms versions 8.3 and earlier Description: The issue affects the /user/ppsave.php component, allowing File Delete to getshell, which can lead to getshell. Recommendations: For zzcms versions 8.3 and earlier, consider restricting access to th...

CVE-2019-1010151: Improper Limitation of a Pathname to a Restricted Directory

zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell. The impact is: getshell. The component is: /user/ppsave.php...

CVE-2018-8965

An issue was discovered in zzcms 8.2. user/ppsave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-8965: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in zzcms 8.2. user/ppsave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...