CVE-2026-105268

The Gitea application contains an authorization flaw in its issue attachment API routes (/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}). The vulnerability allows a user who opened an issue to rename or delete attachments that were actually posted in comments by other users. T...

CVE-2026-105268 Gitea issue attachment API allows changing comment attachments

The Gitea API routes for issue attachments /api/v1/repos/owner/repo/issues/index/assets/attachmentid also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete...

EUVD-2026-94064

The Gitea API routes for issue attachments /api/v1/repos/owner/repo/issues/index/assets/attachmentid also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete...

CVE-2026-105268 Gitea issue attachment API allows changing comment attachments

The Gitea API routes for issue attachments /api/v1/repos/owner/repo/issues/index/assets/attachmentid also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete...

CVE-2026-94278

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

CVE-2026-94278 File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

CVE-2026-94278 File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

CVE-2026-94278

The File Media Renamer WordPress plugin (versions

EUVD-2026-92968

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

WordPress File Media Renamer plugin <= 1.3 - Author+ Arbitrary File Rename vulnerability

Author+ Arbitrary File Rename vulnerability discovered by Sebastian Riveros in WordPress Plugin File Media Renamer versions = 1.3...

PT-2026-106340

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

PT-2026-107294

The Gitea API routes for issue attachments /api/v1/repos/owner/repo/issues/index/assets/attachment id also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete...

EUVD-2026-75665

pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods...

CVE-2025-34085

CVE-2025-34085 — WordPress Simple File List बिना प्रमाणीकरण के RCE एक्सप्लॉइट CVE-2025-34085 के लिए एक स्वचालित एक्सप्लॉइट और स्कैनर, जो WordPress Simple File List प्लगइन में एक गंभीर कमजोरी है, जो मनमानी फ़ाइल अपलोड और नाम बदलने की कार्यक्षमताओं के माध्यम से बिना प्रमाणीकरण के रिमोट कोड निष्पादन...

laravel-filemanager-unrestricted-upload

Laravel FileManager असीमित फाइल अपलोड CVE-2025-56399 CWE-434: खतरनाक प्रकार की फाइल का असीमित अपलोड CVSS स्कोर: 8.5 उच्च 📋 विवरण यह उपकरण CVE-2025-56399 के लिए एक प्रूफ ऑफ कॉन्सेप्ट PoC प्रदान करता है, जो alexusmai/laravel-file-manager संस्करण ≤ 3.3.1 में एक गंभीर कमजोरी है। यह कमजोरी एक प्रमाणित...

CVE-2025-56399

CVE-2025-56399 – تنفيذ تعليمات برمجية عن بُعد مصادق عليه في laravel-file-manager الإصدار 3.3.1 🧭 نظرة عامة ثغرة تنفيذ تعليمات برمجية عن بُعد RCE مصادق عليها في laravel-file-manager الإصدار 3.3.1 والإصدارات الأقدم تسمح للمهاجمين الذين لديهم إمكانية الوصول إلى واجهة مدير الملفات بتنفيذ تعليمات برمج...

POC-CVE-2026-58048

CVE-2026-58048 CVSS 4.0: 9.4 حرجة | CWE-89: SQL Injection | NVD مستخدم cPanel مُصادَق عليه → SQL عشوائي بصلاحيات جذر MySQL عبر إعادة تسمية قاعدة البيانات. يحتفظ cPanel بشكل غير صحيح بإعداد sqlmode لجلسة المستخدم ANSIQUOTES عند تنفيذ عمليات إعادة التسمية كجذر — حيث تكسر علامة backtick في اسم قاعدة...

CVE-2026-37071

CVE-2026-37071 Veno File Manager Project 4.4.9 में Actions::renameFile फ़ंक्शन में मनमाना फ़ाइल नाम परिवर्तन Arbitrary File Rename से विशेषाधिकार वृद्धि Privilege Escalation होती है, जो 'rename' अनुमति वाले प्रमाणित हमलावर को प्रभावित एंडपॉइंट पर विशेष रूप से तैयार POST अनुरोध भेजकर एप्लिकेशन...

CVE-2024-44871

MoziloCMS = 3.0.1 RCE موثقة الوصف هذا السكريبت هو أداة استغلال مصممة لاختبار تطبيقات الويب التي تعمل بنظام MoziloCMS. يسمح للمهاجم باستخدام بيانات تسجيل الدخول للمسؤول لرفع قشرة ويب PHP عبر ملف jpg، وإعادة تسمية الملف المرفوع إلى php، وإرسال أوامر النظام إلى الهدف عبر ملف php. ⚠️ تحذير: هذا النص...

CVE-2026-65891

CVE-2026-65891 — PoC لإعادة تسمية Joomla JCE ماسح ضوئي لإثبات المفهوم لثغرة CVE-2026-65891 في إضافة محرر محتوى Joomla JCE. يسمح التحقق غير السليم من المدخلات في دالة rename إعادة التسمية في مدير ملفات JCE لمستخدم مصادق يمتلك صلاحيات إدارة الملفات بما يلي: إنشاء ملفات مخفية أسماء تبدأ بنقطة، مثل...