https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 02:13:11 +0000 https://cve.radiocsirt.org/vuln/cnvd-2018-15307 cnvd-2018-15307 https://cve.radiocsirt.org/vuln/cnvd-2018-15307 https://cve.radiocsirt.org/vuln/euvd-2026-66092 EUVD-2026-66092 https://cve.radiocsirt.org/vuln/euvd-2026-66092 https://cve.radiocsirt.org/vuln/fkie_cve-2018-12895 <p>WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the wp-includes/post.php wp_delete_attachment function. The attacker must have capabilities for files and posts that are normally available only to the Author, Editor, and Administrator roles. The attack methodology is to delete wp-config.php and then launch a new installation process to increase the attacker&#39;s privileges.</p> <p>WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the wp-includes/post.php wp_delete_attachment function. The attacker must have capabilities for files and posts that are normally available only to the Author, Editor, and Administrator roles. The attack methodology is to delete wp-config.php and then launch a new installation process to increase the attacker&#39;s privileges.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2018-12895 https://cve.radiocsirt.org/vuln/ghsa-v8xj-g4jr-hwhf <p>WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the wp-includes/post.php wp_delete_attachment function. The attacker must have capabilities for files and posts that are normally available only to the Author, Editor, and Administrator roles. The attack methodology is to delete wp-config.php and then launch a new installation process to increase the attacker&#39;s privileges.</p> <p>WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the wp-includes/post.php wp_delete_attachment function. The attacker must have capabilities for files and posts that are normally available only to the Author, Editor, and Administrator roles. The attack methodology is to delete wp-config.php and then launch a new installation process to increase the attacker&#39;s privileges.</p> https://cve.radiocsirt.org/vuln/ghsa-v8xj-g4jr-hwhf https://cve.radiocsirt.org/vuln/gsd-2018-12895 gsd-2018-12895 https://cve.radiocsirt.org/vuln/gsd-2018-12895 https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-12895 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: wordpress, Ubuntu:18.04:LTS: wordpress</p> <p>WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the wp-includes/post.php wp_delete_attachment function. The attacker must have capabilities for files and posts that are normally available only to the Author, Editor, and Administrator roles. The attack methodology is to delete wp-config.php and then launch a new installation process to increase the attacker&#39;s privileges.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: wordpress, Ubuntu:18.04:LTS: wordpress</p> <p>WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the wp-includes/post.php wp_delete_attachment function. The attacker must have capabilities for files and posts that are normally available only to the Author, Editor, and Administrator roles. The attack methodology is to delete wp-config.php and then launch a new installation process to increase the attacker&#39;s privileges.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-12895