Simple File List < 6.1.13 - Reflected Cross-Site Scripting

Simple File List WordPress plugin \u003C 6.1.13 contains a reflected cross-site scripting caused by unsanitized URL output in an attribute, letting attackers execute malicious scripts in admin browsers, exploit requires victim to be an admin. id: CVE-2024-10146 info: name: Simple File List 6.1.13...

WordPress Simple File List - Path Traversal

Simple File List plugin allows path traversal via file upload, enabling files to be written outside the upload directory. id: CVE-2020-12832 info: name: WordPress Simple File List - Path Traversal author: riteshs4hu severity: critical description: | Simple File List plugin allows path traversal v...

CVE-2025-34085-Multi-target

CVE-2025-34085 多目标 RCE 扫描器 CVE-2025-34085 的大规模利用扫描器 —— 针对 WordPress Simple File List 插件的未认证远程代码执行漏洞。 该工具上传一个伪装成图片的 PHP 载荷，通过易受攻击的文件引擎重命名，并用自定义命令触发 shell 执行。支持多线程扫描大规模目标集。 🔥 功能特性 多目标扫描（从 targets.txt 读取） 自动上传并重命名恶意载荷 可自定义命令的 WebShell 触发 线程化执行以提高速度 成功 RCE 记录到 vuln.txt ⚙️ 使用方法 python3 CVE-2025-34085.p...

Simple File List < 4.4.12 - Cross Site Scripting

The plugin does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting id: CVE-2022-3062 info: name: Simple File List 4.4.12 - Cross Site Scripting author: r3Y3r53 severity: medium description: | The plugin does not escape parameters before...

simple-file-list-rce

simple-file-list-rce Simple File List 4.2.3 - Subida de archivos arbitraria no autenticada RCE usage: simple.py -h -u URL -f1 FILE1 -f2 FILE2 -p PATH optional arguments: -h, --help show this help message and exit -u URL, --url URL Wordpress Url i.e https://wordpress.lan -f1 FILE1, --file1 FILE1...

CVE-2025-34085

📂 Simple File List – 未认证的远程代码执行漏洞利用 CVE-2025-34085 ⚠️ 漏洞利用代码作者：Mrj Haxcore 一个针对 WordPress Simple File List 插件 = 4.2.3 的完整 Python 漏洞利用脚本，该插件因不安全的文件上传和重命名逻辑而存在未认证的远程代码执行 RCE 漏洞。 💣 漏洞摘要 插件 ：Simple File List simple-file-list 版本 ：= 4.2.3 CVE ：CVE-2025-34085 影响 ：未认证用户可上传伪装成 .png 的 PHP 文件，随后将其重命名为 .php...

CVE-2022-1119

CVE-2022-1119 1.简介 WordPress Simple File List 3.2.8 FileRead POC 2.用法 poc -f host.txt // 批量扫描 poc -h 192.168.1.1 // 单个扫描 3.免责声明 此工具仅用于学习、研究和自查。 不应用于非法目的，请遵守相关法律法规。 使用本工具产生的任何风险与本人无关！...

CVE-2025-34085

Cyberlone Indonesia 🛠️ WordPress Simple File List RCE 扫描器 + 自动清理 用于检测和利用 WordPress Simple File List 插件上无需身份验证的 远程代码执行（RCE） 漏洞的自动化工具，尤其针对受 CVE-2025-34085 影响的版本。 内置目标自动清理系统，并支持多线程，适合大规模高效扫描。 📌 漏洞信息 CVE ID : CVE-2025-34085 组件 : WordPress 插件 – Simple File List 类型 : 文件上传 + 重命名 → 远程代码执行 访问权限 : 无需身份验证 状态...

CVE-2025-34085

CVE-2025-34085 — WordPress Simple File List 未认证远程代码执行漏洞 针对 CVE-2025-34085 （与 CVE-2020-36847 重复）的自动化利用工具，该漏洞是 WordPress Simple File List 插件版本 ≤ 4.2.2 中的一个关键未认证远程代码执行漏洞。 注意： CVE-2025-34085 被 MITRE 驳回，认为是 CVE-2020-36847 的重复。该漏洞确实存在，并在 4.2.3 版本中得到修复。两个 CVE ID 指向同一底层问题。 漏洞概要 字段| 详情 ---|--- CVE|...

CVE-2025-34085

CVE-2025-34085 — WordPress Simple File List 未认证远程代码执行漏洞利用 针对 CVE-2025-34085 的自动化利用与扫描器，该漏洞存在于 WordPress Simple File List 插件中，通过任意文件上传和重命名功能实现未认证远程代码执行 。 📄 CVE 概要 CVE ID: CVE-2025-34085 受影响组件: WordPress 插件 — Simple File List 漏洞类型: 未认证文件上传和文件重命名为可执行文件 影响: 远程代码执行 RCE 漏洞利用作者: 0xgh057r3c0n 攻击途径: 远程，未认...

By-Poloss..-..CVE-2026-11912

CVE-2026-11912：Simple File List eeListSettings'AllowFrontManage' != 'YES' return; isadmin 函数在 AJAX 请求中返回 FALSE，导致在评估 AllowFrontManage 设置之前授权检查即提前短路。 3. Nonce 泄露 ：安全 nonce eeSFLActionNonce 通过 wpcreatenonce 生成，并暴露在前端 HTML 源代码中，允许攻击者在无需认证的情况下提取它。 影响评估 机密性影响：高 可通过文件列表读取文件内容 文件元数据（名称、大小、日期）被暴露...

WordPress Simple File List plugin <= 6.3.11 - Unauthenticated Stored XSS via File Description vulnerability

Unauthenticated Stored XSS via File Description vulnerability discovered by Ruwantha Harshamal in WordPress Plugin Simple File List versions = 6.3.11...

WordPress Simple File List plugin <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal vulnerability

Unauthenticated Arbitrary File Read and Move via Path Traversal vulnerability discovered by Sanjar Tulkinov in WordPress Plugin Simple File List versions = 6.3.11...

CVE-2026-16616

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure a...

CVE-2026-16617

The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users when front-end file management is enabled to perform Stored Cross-Site Scripting attacks that execute in the...

EUVD-2026-62272

The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users when front-end file management is enabled to perform Stored Cross-Site Scripting attacks that execute in the...

CVE-2026-16616 Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure a...

CVE-2026-16616 Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure a...

CVE-2026-16617

The Simple File List WordPress plugin (versions

EUVD-2026-62271

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure a...