Arbitrary-File-Deletion — PoC Archivehttps://poc.intelseclab.com/tags/arbitrary-file-deletion/Latest proof-of-concept entries.Hugoen-usMon, 27 Jul 2026 00:00:00 +0000Joomla Helix Ultimate Framework — Unauthenticated Arbitrary File Deletion (CVE-2026-57830)https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-57830-joomla-helix-ultimate-file-deletion/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-57830-joomla-helix-ultimate-file-deletion/Critical severity (CVSS 9.1) — web · CVE-2026-57830. Status: Weaponized. Affects: Helix Ultimate Framework (plg_system_helixultimate), the JoomShaper Joomla template framework bundled with virtually every JoomShaper Joomla template. Tags: joomla, helix-ultimate, joomshaper, arbitrary-file-deletion, cwe-862, unauthenticated, csrf-token-only-check.webCriticaljoomlahelix-ultimatejoomshaperarbitrary-file-deletioncwe-862unauthenticatedcsrf-token-only-checkVeno File Manager Arbitrary File Deletion (CVE-2026-37065)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-37065-veno-file-manager-file-deletion/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-37065-veno-file-manager-file-deletion/High severity — web · CVE-2026-37065. Status: PoC. Affects: Veno File Manager Project. Tags: veno-file-manager, arbitrary-file-deletion, authenticated, superadmin, cwe-22.webHighveno-file-managerarbitrary-file-deletionauthenticatedsuperadmincwe-22Perfmatters WordPress Plugin Arbitrary File Deletion (CVE-2026-4350)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4350-perfmatters-file-deletion/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4350-perfmatters-file-deletion/High severity (CVSS 8.1) — web · CVE-2026-4350. Status: PoC. Affects: Perfmatters WordPress plugin. Tags: wordpress, plugin, perfmatters, path-traversal, arbitrary-file-deletion, admin-ajax, dos, nuclei.webHighwordpresspluginperfmatterspath-traversalarbitrary-file-deletionadmin-ajaxdosnucleiLangflow Knowledge Base Path Traversal / Arbitrary Directory Deletion (CVE-2026-42048)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-42048-langflow-kb-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-42048-langflow-kb-path-traversal/High severity — web · CVE-2026-42048 (GHSA-9whx-c884-c68q). Status: PoC. Affects: Langflow (Knowledge Bases bulk delete API). Tags: langflow, path-traversal, arbitrary-file-deletion, cwe-22, api, docker-lab, knowledge-base.webHighlangflowpath-traversalarbitrary-file-deletioncwe-22apidocker-labknowledge-baseGravity Forms Path Traversal → Arbitrary File Deletion (CVE-2026-48866)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48866-gravityforms-path-traversal-file-deletion/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48866-gravityforms-path-traversal-file-deletion/Critical severity (CVSS 9.6) — web · CVE-2026-48866. Status: PoC. Affects: Gravity Forms plugin for WordPress. Tags: wordpress, gravity-forms, path-traversal, cwe-22, arbitrary-file-deletion, php, unauthenticated-injection.webCriticalwordpressgravity-formspath-traversalcwe-22arbitrary-file-deletionphpunauthenticated-injectionGogs Wiki Arbitrary File Deletion via Path Traversal (CVE-2026-24135)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24135-gogs-wiki-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24135-gogs-wiki-path-traversal/High severity (CVSS 7.5) — web · CVE-2026-24135 (GHSA-jp7c-wj6q-3qf2). Status: PoC. Affects: Gogs self-hosted Git service. Tags: gogs, path-traversal, arbitrary-file-deletion, wiki, git-service, authenticated, go.webHighgogspath-traversalarbitrary-file-deletionwikigit-serviceauthenticatedgo