Vendor
GoFound versions 1.4.1 and earlier are vulnerable to unauthenticated path traversal via the database parameter, allowing attackers to delete arbitrary directories on the host file system.