CVE-2019-1315

Windows Error Reporting Manager 임의 파일 이동 권한 상승 자세한 내용: https://offsec.almond.consulting/windows-error-reporting-arbitrary-file-move-eop.html 실행하려면 NtApiDotNet 라이브러리와 유효한 Report.wer 파일이 필요하며, 둘 다 poc.ps1 스크립트와 동일한 디렉터리에 있어야 합니다. WER 보고서 파일을 생성하려면 PowerShell에서 Environment::FailFast'Error' 명령을 실행하고...

SysTracingPoc

SysTracingPoc CVE-2020-0668 - Microsoft Windows 서비스 추적 임의 파일 이동 로컬 권한 상승 취약점 자세한 내용: https://itm4n.github.io/cve-2020-0668-windows-service-tracing-eop/...

CVE-2020-0668

CVE-2020-0668 CVE-2020-0668을 사용하여 임의의 권한 있는 파일 이동 작업을 수행합니다. 권한 상승을 위해 https://github.com/itm4n/UsoDllLoader Windows 1903 이상 또는 https://github.com/xct/diaghub Windows 1903 미만를 사용하십시오. 데모 링크 및 리소스 https://itm4n.github.io/cve-2020-0668-windows-service-tracing-eop/...

RazerEoP

RazerEoP Razer Synapse 3 매크로 모듈의 임의 파일 삭제/이동 PoC입니다. 이 모듈은 사용자가 생성한 매크로를 디스크의 파일로 내보낼 수 있게 하며, 파일 작업은 nt authority\system으로 실행되는 razer 서비스를 통해 수행됩니다. Razer의 BB 프로그램을 통해 이를 보고하려고 했지만, 버그가 아니라 익스플로잇이라는 답변을 받았습니다 🤣. 이후 HackerOne에 보고했지만, 보고서의 기한이 지나서 Informative로 종결되었습니다. 영향을 받는 버전 은 3.7.1209.121307...

CVE-2024-21111

CVE-2024-21111 Oracle VirtualBox 7.0.16 이전 버전은 심볼릭 링크 추적을 통한 로컬 권한 상승 취약점이 있으며, 이로 인해 임의 파일 삭제 및 임의 파일 이동이 가능합니다. VirtualBox는 모든 사용자가 쓸 수 있는 C:\ProgramData\VirtualBox의 로그 파일을 NT AUTHORITY\SYSTEM 권한으로 이동하여 일련번호 방식으로 백업하려고 시도하지만, 최대 10개의 로그만 백업합니다. VirtualBox는 또한 NT AUTHORITY\SYSTEM 권한으로 11번째 로그를...

CVE-2026-77757

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...

CVE-2026-77757 Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...

CVE-2026-77757

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin (versions 8.5-8.9.2 ) is vulnerable to an arbitrary image move flaw. The root cause is a failure to sanitize user-supplied image references when used as a source for a file move operation, specifically duri...

CVE-2026-77757 Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...

PT-2026-81967

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...

WordPress Simple File List plugin <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal vulnerability

Unauthenticated Arbitrary File Read and Move via Path Traversal vulnerability discovered by Sanjar Tulkinov in WordPress Plugin Simple File List versions = 6.3.11...

CVE-2026-16616 Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure a...

CVE-2026-16616

The Simple File List WordPress plugin (versions prior to 6.3.12 ) is vulnerable to an unauthenticated path traversal vulnerability. The root cause is a lack of validation in the source path of a file-move operation reachable by unauthenticated users. This allows an attacker to read arbitrary file...

CVE-2026-65896: External Control of File Name or Path

Grav API Plugin Composer package getgrav/grav-plugin-api before 1.0.10 fails to properly validate the slug field in the POST /pages/route/move endpoint. PagesController::move sanitizes the slug only with ltrim$body'slug', '.', which strips leading periods but does not neutralize '/' or '..'...

CVE-2026-10834 WP Travel Engine < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image

The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their...

CVE-2026-10834

The WP Travel Engine WordPress plugin (versions prior to 6.8.1 ) is vulnerable to an arbitrary file move issue because it fails to properly validate the source of a user-supplied profile image path before moving the file. Authenticated users with subscriber-level access and above can exploit this...

EUVD-2026-42010

The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their...

GO-2026-5162 Gotenberg has an ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names that Allows Arbitrary File Rename and Move in github.com/gotenberg/gotenberg

Gotenberg has an ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names that Allows Arbitrary File Rename and Move in github.com/gotenberg/gotenberg...

CVE-2026-11429

Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename component is used to construct the destination path without validation, allowing arbitrary files to be written to any location writable by th...

CVE-2026-44258: Improper Neutralization of Special Elements used in an OS Command

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfindercheckRisk function validates target and targets for path traversal and home containment, but does not validate the dst destination parameter used by elfinderpaste. An attacker can copy or move files from within the home...