CVE-2026-64946

The Pandora FMS monitoring platform is affected by a chained vulnerability involving CSRF and unrestricted SVG file upload within the File Manager module . This flaw allows for stored Cross-Site Scripting (XSS) , which can be leveraged to exfiltrate session cookies and perform administrator accou...

EUVD-2026-90593

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards...

FuguHub-8.1-Reflected-SVG-XSS-CVE-2025-65790

CVE-2025-65790 - FuguHub 8.1 リフレクテッド SVG XSS FuguHub における SVG レンダリングを介したリフレクテッドクロスサイトスクリプティング XSS https://vulners.com/cve/CVE-2025-65790 このリポジトリは、FuguHub 8.1 におけるリフレクテッドクロスサイトスクリプティング XSS の脆弱性を文書化しています。この脆弱性では、内部ファイルマネージャー /fs/ インターフェースを介して SVG ファイルを表示すると、インライン JavaScript を含む SVG ファイルが実行されます。...

CVE-2026-102842

A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function appuserloginmodel.php::cekUserLogin of the file application/models/appuserloginmodel.php of the component KCFinder File Manager. Such manipulatio...

EUVD-2026-89543

A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function appuserloginmodel.php::cekUserLogin of the file application/models/appuserloginmodel.php of the component KCFinder File Manager. Such manipulatio...

CVE-2026-102842 gedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted upload

A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function appuserloginmodel.php::cekUserLogin of the file application/models/appuserloginmodel.php of the component KCFinder File Manager. Such manipulatio...

CVE-2026-102842 gedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted upload

A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function appuserloginmodel.php::cekUserLogin of the file application/models/appuserloginmodel.php of the component KCFinder File Manager. Such manipulatio...

CVE-2026-102842

A vulnerability exists in the KCFinder File Manager component of gedelumbung HospitalManagement (up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8). The root cause is located in the app_user_login_model.php::cekUserLogin function within the application/models/app_user_login_model.php file, wh...

FileManager

ファイルマネージャー CVE-2022-46689のために寄せ集めたファイルマネージャー...

wp-file-manager-exploit-CVE-2020-25213-with-Zerologon

wp-file-manager-exploit-CVE-2020-25213-with-Zerologon 课程作业项目 NT205.P21.ANTT 网络攻击 利用Zerologon漏洞攻击Windows Server 2019，使用Garble、Chisel、Evil-WinRM、Impacket以及客户端机器上的易受攻击的WordPress插件 视频演示：https://www.youtube.com/watch?v=t-GOHGlP1to...

wordpress-rce-vapt-cve-2020-25213

WordPress RCE 利用与缓解措施 CVE-2020-25213 📌 项目概述 本项目是为 IE4012 – 进攻性黑客战术与策略 模块开发的。 它在受控实验环境中演示了完整的网络安全攻击生命周期，包括： 社会工程攻击 恶意软件模拟 漏洞利用 VAPT 分析 安全补丁实施 🎯 目标漏洞 CVE 编号： CVE-2020-25213 漏洞： WordPress 文件管理器插件远程代码执行 严重性： 严重 CVSS 9.8 类型： 未认证文件上传 → 远程代码执行 🧪 实验环境 角色| 操作系统| IP 地址 ---|---|--- 攻击者| Kali Linux| x.x.x.x...

CVE-2026-8380

CVE-2026-8380 CVE-2026-8380 — Frontend File Manager = 23.6 任意投稿削除 概要 WordPressプラグイン Frontend File Manager nmedia-user-file-uploader のバージョン = 23.6 に、重大な認可の欠陥が確認されました。 この脆弱性により、低権限の認証済みユーザーが、AJAX削除エンドポイントにおける不適切な認可検証のため、任意のWordPress投稿、固定ページ、添付ファイル、カスタム投稿タイプを恒久的に削除できます。 プラグインオプション allowguestupload=y...

WordPress File Manager plugin 7.2.2-8.0.4 - Unauthenticated Database Backup Disclosure vulnerability

Unauthenticated Database Backup Disclosure vulnerability discovered by Jakub Herman in WordPress Plugin File Manager versions 7.2.2-8.0.4...

WordPress File Manager Pro plugin < 2.1.3 - DOM-based XSS vulnerability

DOM-based XSS vulnerability discovered by Mutantgun in WordPress Plugin File Manager Pro versions 2.1.3...

WordPress File Manager plugin < 8.0.5 - DOM-based XSS vulnerability

DOM-based XSS vulnerability discovered by Mutantgun in WordPress Plugin Bit File Manager versions 8.0.5...

CVE-2026-85081

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-19708

The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and...

EUVD-2026-87534

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-85081 Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-85081

Multiple WordPress plugins—File Manager (before 8.0.5), FileOrganizer (before 1.2.1), and File Manager Pro (before 2.1.3)—are vulnerable to a DOM-based XSS due to improper validation of postMessage origins. The flaw exists in the bundled file-manager library (versions below 2.1.70), where the app...