CVE-2020-10567

POC-CVE-2020-10567 RCE poc - RESPONSIVE filemanager v.9.14.0. not Main branche ⚠️ Github project : https://github.com/trippo/ResponsiveFilemanager Requirements: Nothing is required, this exploit is unauthenticated. The Responsive Filemanager application is a web-based file management tool used to...

cve-2026-16219-croogo-lab

CVE-2026-16219: Croogo FileManager defensive lab This repository documents and safely demonstrates the path-authorization flaw tracked as CVE-2026-16219 in Croogo CMS. It is intended for defenders, maintainers, students, and researchers testing systems they own or are explicitly authorized to...

CVE-2018-15961

CVE-2018-15961 - Adobe ColdFusion 2018 RCE This repository contains my exploit code for the RCE vulnerability in Adobe ColdFusion 2018. Exploit Description The exploit sends a POST request containing a JSP reverse shell to /cfscripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm. If...

CVE-2024-21546

UniSharp Laravel Filemanager Unauthenticated RCE CVE-2024-21546 This repository contains security assessment tooling, detection templates, and an automated exploit toolkit for identifying and exploiting Unauthenticated Remote Code Execution RCE in applications utilizing the...

CVE-2026-37637

CVE-2026-37637 Proof of Concept for CVE-2026-37637 - Remote Code Execution in Alexantr filemanager v1.0 via unrestricted file upload in filemanager.php. Overview CVE-2026-37637 is a Remote Code Execution vulnerability affecting Alexantr filemanager v1.0. The vulnerability exists in the...

cpanel-cve-41940-detector

Detector de IOC de cPanel para CVE-2026-41940 Detector de IOC de solo lectura para servidores cPanel/WHM que puedan haber sido afectados por CVE-2026-41940 y actividad posterior al compromiso relacionada. El script ayuda a un operador a revisar indicadores de ransomware .sorry, rastros de backdoo...

FileManager

FileManager Hacked together File Manager for CVE-2022-46689...

CVE-2026-104452

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, ...

CVE-2026-104452

Versions of YesWiki prior to 4.6.7 are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability within the filemanager page handler . The root cause is the failure to validate a CSRF token on GET requests that perform file operations. An attacker could trick a logged-in administrator or p...

EUVD-2026-91463

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, ...

CVE-2026-104452 YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, ...

CVE-2026-104452 YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, ...

CVE-2026-104452 YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, ...

CVE-2026-104452: Cross-Site Request Forgery (CSRF)

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, ...

PT-2026-104262

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, ...

CVE-2026-100520

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...

CVE-2026-100520 Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...

CVE-2026-100520 Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...

EUVD-2026-87375

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...

CVE-2026-100520

Laranode versions before 1.2.1 are vulnerable to a path traversal vulnerability within the POST /filemanager/upload-file endpoint. This flaw allows authenticated users to bypass directory restrictions by supplying traversal sequences in the path parameter. Consequently, an attacker can write arbi...