CVE-2025-65879

Warehouse Management System 1.2 contains an authenticated arbitrary file deletion vulnerability. The /goods/deleteGoods endpoint accepts a user-controlled goodsimg parameter, which is directly concatenated with the server's UPLOAD_PATH and passed to File.delete() without validation. A remote authenticated attacker can delete arbitrary files on the server by supplying directory traversal payloads.

• CWE-22

• https://github.com/W000i/vuln/issues/3Exploit, Issue Tracking, Third Party Advisory

Published

Dec 5, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-65865An integer overflow in eProsima Fast-DDS v3.3 allows attacke…7.5
• CVE-2025-65868XML external entity (XXE) injection in eyoucms v1.7.1 allows…7.5
• CVE-2025-6587System environment variables are recorded in Docker Desktop …5.2
• CVE-2025-65875An arbitrary file upload vulnerability in the AddFont() func…9.8
• CVE-2025-65877Lvzhou CMS before commit c4ea0eb9cab5f6739b2c87e77d9ef304017…7.5
• CVE-2025-65878The warehouse management system version 1.2 contains an arbi…7.5
• CVE-2025-6588The FunnelCockpit plugin for WordPress is vulnerable to Refl…6.1
• CVE-2025-65881Sourcecodester Zoo Management System v1.0 is vulnerable to C…6.1
• CVE-2025-65882An issue was discovered in openmptcprouter thru 0.64 in file…9.8
• CVE-2025-65883A vulnerability has been identified in Genexis Platinum P441…8.4
• CVE-2025-65885An issue was discovered in the Delight Custom Firmware (CFW)…5.1
• CVE-2025-65886A shape mismatch vulnerability in OneFlow v0.9.0 allows atta…7.5