wp-file-manager-0day

CVE-2020-25213 wp-file-manager 6.7 20th Aug 2020 Wordpress Plugin 0day elFinder vulnerability is a well-know vulnerability, my script only changes path to "/wp-content/plugins/wp-file-manager/". Stop requesting fixes in script or something else for me. RTFM... References:...

Heroinn

English · 简体中文 Heroinn Heroinn is a cross-platform command-and-control and post-exploitation framework written in Rust. It combines a desktop server application, lightweight agents, an interactive PTY shell, a resumable file manager, and a client generator for authorized security research and...

CVE-2021-45010-TinyFileManager-Exploit

CVE-2021-45010 CVE-2021-45010: A Path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager Project’s Tiny File Manager = 2.4.3 allows remote attackers with valid user accounts to upload malicious PHP files to the webroot and achieve code execution o...

FileManager

FileManager Hacked together File Manager for CVE-2022-46689...

wp-file-manager-CVE-2020-25213

WP-file-manager expoit CVE-2020-25213 WP-file-manager wordpress plugin 6.9 vulnerable to unauthenticated arbitary file upload resulting in full compromise of the system. For More more details refer to my writeup published here Disclaimer I haven't discovered this vulnerability & neither taking an...

laravel-filemanager-unrestricted-upload

Laravel FileManager Unrestricted File Upload CVE-2025-56399 CWE-434: Unrestricted Upload of File with Dangerous Type CVSS Score: 8.5 High 📋 Description This tool provides a Proof of Concept PoC for CVE-2025-56399 , a critical vulnerability in alexusmai/laravel-file-manager versions ≤ 3.3.1. The...

BetterRAT

Information BetterRAT is InfinityRATDiamondRAT Based Next Generation RAT All responsibilities are at your own risk. Please use it only for research purposes. Feature Remote Desktop Remote Connection Controller Remote Keylogger Remote File Manager Remote TaskManager Remote Script...

CVE-2026-100520-laranode-path-traversal

CVE-2026-100520 — Path Traversal → RCE in Laranode File Manager Authorized security research. PoC for defensive and educational use only. Authenticated path traversal in the file-manager upload endpoint of Laranode lets a low-privileged tenant write arbitrary files outside their own home director...

CVE-2026-37064

CVE-2026-37064 User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user...

CVE-2026-12277

CVE-2026-12277 Frontend File Manager Plugin WordPress = 23.6 - Unauthenticated Arbitrary File Deletion to RCE Summary Field| Value ---|--- CVE| CVE-2026-12277 Plugin| Frontend File Manager Plugin nmedia-user-file-uploader Affected| = 23.6 Type| Unauthenticated Arbitrary File Deletion CVSS| 8.7 HI...

Eden-RAT

Eden-RAT Background While developing EgoDrop and DuplexSpy, I successfully implemented an interactive shell within a C-based GUI application. I then recalled one of my earlier projects that had been suspended due to my limited development experience at the time. Therefore, I decided to revisit an...

wp-file-manager

wp-file-manager WP File Manager 6.9 - Arbitrary File Upload leading to RCE usage: wp-file-manager.py -h -u URL -f FILE optional arguments: -h, --help show this help message and exit -u URL, --url URL URL of host to check will need http or https -f FILE, --file FILE File of URLS to check + Testing...

b4tm4n

B4TM4N PHP WEBSHELL Login Account Default Username : k4mpr3t Password : k4mpr3t Features 0 File Manager 1 Sec. Info 2 Simply Database 3 Interactive terminal 4 PHP Reverse Back Connect 5 Run PHP Code 6 Custom Toolz 7 Self Script Encryptor ! 8 Error Handler 9 Themes Self Script Encryptor Usage :...

CVE-2026-37073

CVE-2026-37073 Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header...

antispy

AntiSpy English | 简体中文 A powerful anti rootkit toolkit AntiSpy is a free but powerful anti virus and rootkits toolkit. It offers you the ability with the highest privileges that can detect,analyze and restore various kernel modifications and hooks. With its assistance,you can easily spot and...

CVE-2026-37071

CVE-2026-37071 Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected...

elFinder < 2.1.58 - Remote Code Execution

studio-42/elfinder before 2.1.58 contains a remote code execution caused by execution of PHP code in a .phar file, letting attackers execute arbitrary PHP code if the server parses .phar files as PHP, exploit requires server to parse .phar files as PHP. id: CVE-2021-23394 info: name: elFinder...

Rumpus FTP Web File Manager 8.2.9.1 - Cross-Site Scripting

Rumpus FTP Web File Manager 8.2.9.1 contains a reflected cross-site scripting vulnerability via the Login page. An attacker can send a crafted link to end users and can execute arbitrary JavaScript. id: CVE-2019-19368 info: name: Rumpus FTP Web File Manager 8.2.9.1 - Cross-Site Scripting author:...

CyberPanel - Command Injection

CyberPanel aka Cyber Panel before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner sink. There is /filemanager/upload aka File Manager upload unauthenticated remote code execution via shell metacharacters. id: CVE-2024-51568 info: name: CyberPanel - Comman...

WordPress Advanced File Manager < 5.4.13 - Arbitrary File Read

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server. id:...