CVE-2026-12277

CVE-2026-12277 Frontend File Manager Plugin WordPress = 23.6 - Unauthenticated Arbitrary File Deletion to RCE Summary Field| Value ---|--- CVE| CVE-2026-12277 Plugin| Frontend File Manager Plugin nmedia-user-file-uploader Affected| = 23.6 Type| Unauthenticated Arbitrary File Deletion CVSS| 8.7 HI...

CVE-2026-37071

CVE-2026-37071 Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected...

CVE-2025-56807

CVE-2025-56807 Description A Stored Cross Site Scripting XSS vulnerability was discovered in FairSketch RISE Ultimate Project Manager & CRM v3.9.4 in the File Manager functionality. The vulnerability lies in the title parameter that is submitted when creating new folders. Due to insufficient inpu...

CVE-2026-37068

CVE-2026-37068 Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected...

CVE-2026-37066

CVE-2026-37066 Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests POST...

CVE-2026-37069

CVE-2026-37069 Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint...

CVE-2026-37067

CVE-2026-37067 Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

CVE-2026-37072

CVE-2026-37072 Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php An unauthenticated attacker can exploit a Local File Inclusion vulnerability in the 'lang' GET parameter. By sending a specially crafted POST request with t...

CVE-2026-37064

CVE-2026-37064 User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user...

CVE-2026-37070

CVE-2026-37070 Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

tinyfilemanager-wh1z-edition

Tiny File Manager WH1Z-Edition Introducing Tiny File Manager WH1Z-Edition, the compact and efficient solution for managing your files and folders with enhanced privacy and security features. Gone are the days of relying on external resources – I've stripped down the code to its core, making it...

CVE-2026-37073

CVE-2026-37073 Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header...

CVE-2024-8743-PoC

CVE-2024-8743 PoC Background Proof-of-Concept script for WordPress plugin Bit File Manager version = 6.5.7 Authenticated Subscriber+ Limited JavaScript File Upload CVE-2024-8743 vulnerability Information Description: The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for...

Eden-RAT

Eden-RAT Background While developing EgoDrop and DuplexSpy, I successfully implemented an interactive shell within a C-based GUI application. I then recalled one of my earlier projects that had been suspended due to my limited development experience at the time. Therefore, I decided to revisit an...

b4tm4n

B4TM4N PHP WEBSHELL Login Account Default Username : k4mpr3t Password : k4mpr3t Features 0 File Manager 1 Sec. Info 2 Simply Database 3 Interactive terminal 4 PHP Reverse Back Connect 5 Run PHP Code 6 Custom Toolz 7 Self Script Encryptor ! 8 Error Handler 9 Themes Self Script Encryptor Usage :...

CVE-2021-32161

..| XSStoCommandInjection2 |.. Description : Exploiting a Reflected Cross-Site Scripting XSS attack to get a Command Injection through the Webmin's File Manager feature Tested Version : Webmin 1.973 GitHub's latest version 07/03/2021 Attack Type: Remote Impact : Command Execution eXploit's C0de P...

CVE-2023-4861-PoC

CVE-2023-4861 PoC This repository contains a Python proof of concept for CVE-2023-4861 , an authenticated remote code execution issue in the WordPress plugin File Manager Pro - Filester. Vulnerability Summary CVE: CVE-2023-4861 Product: File Manager Pro - Filester filester Vulnerable versions:...

CVE-2012-2982-Webmin-Exploit

Webmin 1.590 Remote Command Execution Exploit CVE-2012-2982 Overview This repository contains a Proof-of-Concept PoC exploit for CVE-2012-2982 , a remote authenticated command execution vulnerability affecting Webmin versions 1.590 and earlier. The vulnerability resides in the /file/show.cgi...

CVE-2021-45010-TinyFileManager-Exploit

CVE-2021-45010 CVE-2021-45010: A Path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager Project’s Tiny File Manager = 2.4.3 allows remote attackers with valid user accounts to upload malicious PHP files to the webroot and achieve code execution o...

CVE-2023-43872-CMSmadesimple-Arbitrary-File-Upload--XSS---File-Manager

CMSmadesimple File Upload - XSS v2.2.18 Author: Sergio Description: File upload vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to upload a pdf file with hidden XSS. Attack Vectors: A vulnerability in File Manager file upload sanitation allows you to upload a PDF file with hidden...