By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account

PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay attack

The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication