CVE-2025-56399

CVE-2025-56399 – Authenticated Remote Code Execution in laravel-file-manager v3.3.1 🧭 Overview An authenticated Remote Code Execution RCE vulnerability in laravel-file-manager v3.3.1 and below allows attackers with access to the file manager interface to execute arbitrary code on the server. By...

delete-self-poc

🗑️ delete-self-poc The delete-self-poc is a demonstration of a method to delete a locked executable or currently running file from disk. This concept was initially discovered by Jonas Lykkegaard, and I have created the proof of concept POC for it. Additionally, it can be used to delete locked file...

CVE-2026-65891

CVE-2026-65891 — Joomla JCE Rename PoC Proof-of-concept scanner for CVE-2026-65891 in the Joomla Content Editor JCE extension. Improper input validation in the JCE file manager rename function allows an authenticated user with file-management permissions to: create hidden files dot-prefixed names...

CVE-2024-21546

UniSharp Laravel Filemanager Unauthenticated RCE CVE-2024-21546 This repository contains security assessment tooling, detection templates, and an automated exploit toolkit for identifying and exploiting Unauthenticated Remote Code Execution RCE in applications utilizing the...

Frontend File Manager < 21.3 - Unauthenticated File Renaming

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server id:...

POC-CVE-2026-58048

CVE-2026-58048 CVSS 4.0: 9.4 Critical | CWE-89: SQL Injection | NVD Authenticated cPanel user → arbitrary SQL as MySQL root via database rename. cPanel improperly preserves the user's session sqlmode ANSIQUOTES when executing rename operations as root — a backtick in the database name breaks out ...

CVE-2026-79986

CVE-2026-79986 — camel-azure-files: consumer builds the remote path from the share listing without containment Reproducer repository for the Apache Camel vulnerability where the azure-files consumer — which derives from the same RemoteFileConsumer base class as the other remote-file consumers and...

auto_re

AutoRE Features 1. Auto-renaming dummy-named functions, which have one API call or jump to the imported API Before After 2. Assigning TAGS to functions accordingly to called API-indicators inside Sets tags as repeatable function comments and displays TAG tree in the separate view Some screenshots...

CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV

Executive summary macOS Music and TV do an insecure rename resulting in FDA by gaining full control over the user's TCC.db I reported this bug in separate tickets for each app, feel free to merge if applicable. The underlying problem is that these apps have FDA but fail to sanitize their file...

CVE-2025-34085

📂 Simple File List – Unauthenticated RCE Exploit CVE-2025-34085 ⚠️ Exploit Code by: Mrj Haxcore A fully working Python exploit for the WordPress Simple File List plugin = 4.2.3, which is vulnerable to unauthenticated remote code execution RCE due to insecure file upload and rename logic. 💣...

CVE-2024-44871

MoziloCMS = 3.0.1 Authenticated RCE Description This script is an exploit tool designed for testing web applications running MoziloCMS. It allows an attacker to use admin logins to upload a PHP web shell via jpg file, rename the uploaded file to php, and send system commands to the target through...

laravel-filemanager-unrestricted-upload

Laravel FileManager Unrestricted File Upload CVE-2025-56399 CWE-434: Unrestricted Upload of File with Dangerous Type CVSS Score: 8.5 High 📋 Description This tool provides a Proof of Concept PoC for CVE-2025-56399 , a critical vulnerability in alexusmai/laravel-file-manager versions ≤ 3.3.1. The...

CVE-2025-34085-Multi-target

CVE-2025-34085 Multi-Target RCE Scanner Mass-exploitation scanner for CVE-2025-34085 — an unauthenticated remote code execution vulnerability in the WordPress Simple File List plugin. This tool uploads a PHP payload disguised as an image, renames it via a vulnerable file engine, and triggers shel...

CVE-2025-34085

Cyberlone Indonesia 🛠️ WordPress Simple File List RCE Scanner + Auto-Clean Automated tool to detect and exploit unauthenticated Remote Code Execution RCE on the WordPress Simple File List plugin, specifically those vulnerable to CVE-2025-34085. Equipped with an automatic target cleaning system and...

CVE-2026-37071

CVE-2026-37071 Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected...

CVE-2025-34085

CVE-2025-34085 — WordPress Simple File List Unauthenticated RCE Exploit An automated exploit and scanner for CVE-2025-34085 , a critical vulnerability in the WordPress Simple File List plugin, enabling unauthenticated remote code execution through arbitrary file upload and rename functionalities....

CVE-2026-79985

CVE-2026-79985 — camel-smb: consumer builds the remote path from the share listing without containment Reproducer repository for the Apache Camel vulnerability where the smb consumer builds the remote path of each polled file by concatenating the configured directory with the name reported in the...

CVE-2026-58048-PoC-Exploit

CVE‑2026‑58048 – cPanel Root SQL Execution Toolkit ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING This repository provides tools for authorized security professionals, blue teams, and penetration testers only. Unauthorized access to computer systems is illegal under CFAA US, Computer Misuse Act U...

CVE-2025-23968

AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o The AI Bud plugin exposes a REST API endpoint /wp-json/ai-buddy/v1/wp/attachments that allows uploading files to the WordPress media library. The endpoint’s file logic contains file renaming functionality that triggers after file...

CVE-2026-118043: Unknown Bulk Media Register: The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a…

The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls an...