CVE-2021-32162

..| CSRFtoCommandInjection2 |.. 描述： 利用跨站请求伪造（CSRF）攻击，通过Webmin的文件管理器功能实现命令注入 测试版本： Webmin 1.973（GitHub最新版本 2021年3月7日） 攻击类型： 远程 影响： 命令执行 利用代码POC： 产品供应商： https://www.webmin.com 附加信息： "Webmin 是一款基于Web的Unix-like服务器及服务系统管理工具，全球安装量超过100万。通过它，可以配置操作系统内部设置，如用户、磁盘配额、服务或配置文件，还可以修改和控制开源应用，例如BIND DNS...

Python-CVE-2020-25213

Python-CVE-2020-25213 用于 WP File Manager 漏洞的 Python 交互式利用工具。WordPress 的 File Manager wp-file-manager 插件 6.9 版本之前允许远程攻击者上传并执行任意 PHP 代码，因为它将一个不安全的示例 elFinder 连接器文件重命名为 .php 扩展名。 该脚本使用 argparse、requests、re、sys、os、json 和 random Python 模块。 要通过 pip 安装这些模块，请在命令行中执行以下命令： pip install -r requirements.txt...

CVE-2019-6447

CVE-2019-6447 本文介绍了手动利用ES文件管理器中发现的Android开放端口漏洞。该开放的TCP端口允许攻击者安装后门并收集所有用户数据。此外，本文还将提供概念验证（PoC）来巩固该漏洞，并额外介绍关于后门攻击的概述。下载PDF文档，好好享受吧！！！干杯！！！...

CVE-2025-65345

CVE-2025-65345 – laravel-file-manager v3.3.1 中 Zip 功能的已认证路径遍历导致文件系统泄露 🧭 概述 laravel-file-manager v3.3.1 及以下版本中存在一个已认证的目录遍历漏洞，允许有权访问文件管理器界面的攻击者利用 zip/归档功能创建包含预期范围之外文件和目录的压缩包，原因是路径验证不当。 🧱 受影响组件 项目： laravel-file-manager 组件： zip/归档 Functionf 受影响版本： v3.3.1 及以下版本 🎯 攻击向量 1. 在文件管理器图形界面中上传或选择一个文件夹/文件。 2. 篡...

CVE-2025-63307

CVE-2025-63307 – laravel-file-manager v3.3.1 中的已认证存储型跨站脚本（XSS）漏洞 🧭 概述 laravel-file-manager v3.3.1 及以下版本中存在一个已认证的存储型跨站脚本（XSS）漏洞，允许拥有文件管理器界面访问权限的攻击者在上传或创建的文件中注入并持久化任意 JavaScript 代码。 通过上传包含恶意 JavaScript 的特制 .html 或 .svg 文件，或直接在文件管理器中创建并编辑此类文件，攻击者可实现存储型 XSS，当其他任何已认证用户或管理员通过 Web 界面查看该文件时，恶意脚本将执行。 🧱...

CVE-2026-64950

Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards...

CVE-2026-64949

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards...

CVE-2026-64947

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards...

CVE-2026-64946

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards...

CVE-2025-65346

CVE-2025-65346 – laravel-file-manager v3.3.1 中从 UnZip 函数引发的已认证路径遍历导致任意文件写入 🧭 概述 受影响应用程序的 unzip/解压功能中存在路径遍历漏洞，允许攻击者在归档解压过程中将文件写入文件系统的任意位置。由于解压例程未能清理 ZIP 条目中的目标路径，攻击者可以构造包含遍历序列（例如 ../../routes）或绝对路径的 ZIP 归档。当应用程序处理这些归档时，文件会以运行进程的权限被直接解压到指定位置。 该缺陷可被滥用以覆盖现有文件、植入可执行载荷或修改应用程序行为，从而可能导致远程代码执行。 🧱 受影响组件 项目...

CVE-2026-64950 Stored Cross-Site Scripting via Directory Name in File Manager Create Directory

Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards...

CVE-2026-64950

The Pandora FMS application, from version 777 onwards , is vulnerable to stored Cross-Site Scripting (XSS) due to missing input validation and output encoding on the directory name parameter within the File Manager's Create Directory function. This flaw allows for the execution of malicious scrip...

EUVD-2026-90599

Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards...

CVE-2026-64949

Pandora FMS versions 777 onwards are susceptible to a vulnerability in the File Manager module caused by an incomplete extension blacklist . This flaw allows authenticated users to upload and execute arbitrary .phar files , potentially leading to unauthorized code execution. No specific remediati...

CVE-2026-64949 Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards...

EUVD-2026-90598

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards...

CVE-2026-64947

The Pandora FMS software, version 777 onwards , is vulnerable to a chained CSRF bypass and unrestricted file upload vulnerability within the Plugin File Manager . This flaw allows an attacker to upload and execute arbitrary PHP code , leading to Remote Code Execution (RCE) . No specific remediati...

EUVD-2026-90596

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards...

CVE-2026-64947 CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards...

CVE-2026-64946 CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards...