CVE-2026-64946

The Pandora FMS monitoring platform is affected by a chained vulnerability involving CSRF and unrestricted SVG file upload within the File Manager module . This flaw allows for stored Cross-Site Scripting (XSS) , which can be leveraged to exfiltrate session cookies and perform administrator accou...

EUVD-2026-90593

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards...

FuguHub-8.1-Reflected-SVG-XSS-CVE-2025-65790

CVE-2025-65790 - FuguHub 8.1 반사형 SVG XSS FuguHub의 SVG 렌더링을 통한 반사형 크로스사이트 스크립팅XSS https://vulners.com/cve/CVE-2025-65790 이 저장소는 FuguHub 8.1 의 반사형 크로스사이트 스크립팅XSS 취약점을 문서화한 것으로, 내부 파일 관리자 /fs/ 인터페이스를 통해 SVG 파일을 볼 때 인라인 JavaScript가 포함된 SVG 파일이 실행됩니다. CVE 할당: CVE-2025-65790 발견자: Han Tek Foo 심각도: 높음 영향...

CVE-2026-102842

A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function appuserloginmodel.php::cekUserLogin of the file application/models/appuserloginmodel.php of the component KCFinder File Manager. Such manipulatio...

EUVD-2026-89543

A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function appuserloginmodel.php::cekUserLogin of the file application/models/appuserloginmodel.php of the component KCFinder File Manager. Such manipulatio...

CVE-2026-102842 gedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted upload

A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function appuserloginmodel.php::cekUserLogin of the file application/models/appuserloginmodel.php of the component KCFinder File Manager. Such manipulatio...

CVE-2026-102842 gedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted upload

A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function appuserloginmodel.php::cekUserLogin of the file application/models/appuserloginmodel.php of the component KCFinder File Manager. Such manipulatio...

CVE-2026-102842

A vulnerability exists in the KCFinder File Manager component of gedelumbung HospitalManagement (up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8). The root cause is located in the app_user_login_model.php::cekUserLogin function within the application/models/app_user_login_model.php file, wh...

FileManager

파일 관리자 CVE-2022-46689용 임시로 만든 파일 관리자...

wp-file-manager-exploit-CVE-2020-25213-with-Zerologon

wp-file-manager-exploit-CVE-2020-25213-with-Zerologon 과제 프로젝트 NT205.P21.ANTT 사이버 공격 Zerologon에 취약한 Windows Server 2019를 악용하고, 클라이언트 머신에서 Garble, Chisel, Evil-WinRM, Impacket 및 취약한 WordPress 플러그인을 사용 비디오 데모: https://www.youtube.com/watch?v=t-GOHGlP1to...

wordpress-rce-vapt-cve-2020-25213

WordPress RCE 익스플로잇 및 완화 CVE-2020-25213 📌 프로젝트 개요 이 프로젝트는 IE4012 – 오펜시브 해킹 전술 및 전략 모듈의 일환으로 개발되었습니다. 통제된 실험실 환경에서 전체 사이버 보안 공격 라이프사이클을 시연하며, 다음을 포함합니다: 사회공학 공격 악성코드 시뮬레이션 취약점 익스플로잇 VAPT 분석 보안 패치 구현 🎯 대상 취약점 CVE ID: CVE-2020-25213 취약점: WordPress File Manager 플러그인 원격 코드 실행 심각도: 치명적 CVSS 9.8 유형: 인증되...

CVE-2026-8380

CVE-2026-8380 CVE-2026-8380 — Frontend File Manager = 23.6 임의 게시물 삭제 개요 WordPress 플러그인 Frontend File Managernmedia-user-file-uploader 버전 = 23.6에서 심각한 권한 검증 결함이 발견되었습니다. 이 취약점으로 인해 낮은 권한을 가진 인증 사용자가 AJAX 삭제 엔드포인트의 부적절한 권한 검증으로 인해 임의의 WordPress 게시물, 페이지, 첨부 파일 및 사용자 정의 게시물 유형을 영구적으로 삭제할 수 있습니다. 플러그...

WordPress File Manager plugin 7.2.2-8.0.4 - Unauthenticated Database Backup Disclosure vulnerability

Unauthenticated Database Backup Disclosure vulnerability discovered by Jakub Herman in WordPress Plugin File Manager versions 7.2.2-8.0.4...

WordPress File Manager Pro plugin < 2.1.3 - DOM-based XSS vulnerability

DOM-based XSS vulnerability discovered by Mutantgun in WordPress Plugin File Manager Pro versions 2.1.3...

WordPress File Manager plugin < 8.0.5 - DOM-based XSS vulnerability

DOM-based XSS vulnerability discovered by Mutantgun in WordPress Plugin Bit File Manager versions 8.0.5...

CVE-2026-85081

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-19708

The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and...

EUVD-2026-87534

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-85081 Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-85081

Multiple WordPress plugins—File Manager (before 8.0.5), FileOrganizer (before 1.2.1), and File Manager Pro (before 2.1.3)—are vulnerable to a DOM-based XSS due to improper validation of postMessage origins. The flaw exists in the bundled file-manager library (versions below 2.1.70), where the app...