Easyimage
Monthly
Unauthenticated remote manipulation of the 'hash' argument handled by app/del.php in icret EasyImage (EasyImages2.0) through version 2.8.7 permits improper privilege management, letting an attacker perform unauthorized file deletion and manipulation on a network-exposed instance without any credentials or user interaction. Confidentiality is not affected and integrity/availability impact is rated Low, so the practical outcome is destructive file-level tampering rather than data theft or code execution. A public proof-of-concept reference has been published alongside the report; it is a reference only and is not verified as working exploit code, and no confirmed active exploitation has been reported.
Unauthenticated remote manipulation of the 'hash' argument handled by app/del.php in icret EasyImage (EasyImages2.0) through version 2.8.7 permits improper privilege management, letting an attacker perform unauthorized file deletion and manipulation on a network-exposed instance without any credentials or user interaction. Confidentiality is not affected and integrity/availability impact is rated Low, so the practical outcome is destructive file-level tampering rather than data theft or code execution. A public proof-of-concept reference has been published alongside the report; it is a reference only and is not verified as working exploit code, and no confirmed active exploitation has been reported.