CVE-2025-2032: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability classified as problematic was found in ChestnutCMS 1.5.2. This vulnerability affects the function renameFile of the file /cms/file/rename. The manipulation of the argument rename leads to path traversal. The exploit has been disclosed to the public and may be used...

PT-2025-30765

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists between file renames and directory logging within the Btrfs filesystem. This can lead to file loss if a crash or power failure occurs during the rename process...

PT-2024-16309

Name of the Vulnerable Software and Affected Versions The Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO WordPress plugin versions prior to 1.5.0 Description The issue concerns the failure to sanitise uploaded SVG files, potentially allowing users with a role as lo...

CVE-2024-10482: Improper Neutralization of Input During Web Page Generation

The Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO WordPress plugin before 1.5.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2024-8164

A vulnerability was determined in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. This affects the function rename of the file /Admin/Http/Controllers/FileManagerController.php. This manipulation of the argument newname causes unrestricted upload. The attack can be initiated remotely...

CVE-2024-8164

CVE-2024-8164 affects Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. The flaw resides in the rename function of /Admin/Http/Controllers/FileManagerController.php, where manipulating the argument new_name enables unrestricted upload. The issue can be triggered remotely and was publicl...

CVE-2024-5279 Qiwen Netdisk File Rename cross site scripting

A vulnerability was found in Qiwen Netdisk up to 1.4.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component File Rename Handler. The manipulation with the input leads to cross site scripting. The attack can be launched remotely. The...

CVE-2024-5279 Qiwen Netdisk File Rename cross site scripting

A vulnerability was found in Qiwen Netdisk up to 1.4.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component File Rename Handler. The manipulation with the input leads to cross site scripting. The attack can be launched remotely. The...

PT-2024-35443

Name of the Vulnerable Software and Affected Versions Qiwen Netdisk versions up to 1.4.0 Description A vulnerability was found in the File Rename Handler component, which can be exploited to lead to cross-site scripting. The issue can be triggered by manipulating the input with a malicious string...

CVE-2024-5279: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Qiwen Netdisk up to 1.4.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component File Rename Handler. The manipulation with the input leads to cross site scripting. The attack can be launched remotely. The...

CVE-2024-26307

Possible race condition vulnerability in Apache Doris. Some of code using chmod method. This method run the risk of someone renaming the file out from under user and chmodding the wrong file. This could theoretically happen, but the impact would be minimal. This issue affects Apache Doris: before...

PT-2024-19986 · Geoserver · Geoserver

Name of the Vulnerable Software and Affected Versions: GeoServer versions prior to 2.23.5 and 2.24.2 Description: An arbitrary file renaming issue exists, allowing an authenticated administrator with permissions to modify stores through the REST Coverage Store or Data Store API to rename arbitrar...

GeoServer Security Vulnerabilities

GeoServer is an open source software server written in Java. It allows users to share and edit geospatial data. A security vulnerability exists in GeoServer versions prior to 2.23.5 and prior to 2.24.2, which stems from an arbitrary file renaming vulnerability that allows authenticated...

CVE-2024-0221: Improper Limitation of a Pathname to a Restricted Directory

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.8.19 via the renameitem function. This makes it possible for authenticated attackers to rename arbitrary files on the server. This can lead ...

PT-2024-1419 · Miro · Miro Desktop

Name of the Vulnerable Software and Affected Versions: Miro Desktop version 0.8.18 Description: The issue is related to incorrect code generation management in the Miro digital collaboration platform on macOS, which may allow a remote attacker to execute arbitrary code. The exploitation involves ...

PT-2024-15395

Name of the Vulnerable Software and Affected Versions The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress versions up to, and including, 1.8.19 Description The issue allows authenticated attackers to rename arbitrary files on the server via the rename item function,...

Photo Gallery by 10Web - Mobile-Friendly Image Gallery < 1.8.20 - Directory Traversal to Arbitrary File Rename

Description The plugin is vulnerable to Directory Traversal attacks via the renameitem function. This makes it possible for authenticated attackers to rename arbitrary files on the server. Note: By default this can be exploited by administrators only. In the premium version of the plugin,...

Stored Cross Site Scripting (XSS)

Winter CMS is vulnerable to Stored Cross Site Scripting XSS. The vulnerability is due to improper sanitization within the rename functionality of files after uploads to the Media Manager. This issue can be exploited by an attacker with the media.managemedia permission to upload a file and later...

InterPhoto 2.3.0 Shell Upload

==================================================================================================================================== | Title : InterPhoto 2.3.0 Persians Remote Shell Upload vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

UJCMS path traversal vulnerability

UJCMS is UJCMS open source a Java open source content management system . A security vulnerability exists in UJCMS version 6.0.2. An attacker exploited the vulnerability to move files via the rename function...