EIP-2026-112883

This advisory describes a broken authentication and session management vulnerability in Ultimate PHP Board 2.2.7, allowing an attacker to delete arbitrary files by manipulating request parameters. The writeup includes technical details such as HTTP request analysis and parameter tampering steps.