CVE-2024-7627-PoC

CVE-2024-7627-PoC 배경 이 PoCProof-of-Concept 스크립트는 WordPress 플러그인 Bit File Manager 버전 6.06.5.5의 인증되지 않은 원격 코드 실행Race Condition을 통한CVE-2024-7627 취약점을 위한 것입니다. 정보 설명: WordPress용 Bit File Manager 플러그인은 'checkSyntax' 함수를 통해 버전 6.06.5.5에서 원격 코드 실행에 취약합니다. 이는 파일 유효성 검사를 수행하기 전에 임시 파일을 공개적으로 접근 가능한 디렉터리에 ...

CVE-2024-7627

CVE-2024-7627 익스플로잇 — Bit File Manager WordPress 비인증 RCE 익스플로잇 📌 설명 이 저장소는 Bit File Manager WordPress 플러그인버전 6.0 – 6.5.5에서 발견된 치명적인 비인증 원격 코드 실행RCE 취약점인 CVE-2024-7627 에 대한 개념 증명PoC 익스플로잇을 포함합니다. Guest User Read 기능이 활성화되면 플러그인은 checkSyntax 함수 내부에 레이스 컨디션을 노출합니다. 이 함수는 검증 전에 임시 PHP 파일을...

CVE-2024-8743-PoC

CVE-2024-8743 PoC 背景 针对 WordPress 插件 Bit File Manager 版本 = 6.5.7 中已验证身份（订阅者及以上）有限制 JavaScript 文件上传漏洞 CVE-2024-8743 的概念验证脚本 信息 描述： Bit File Manager – 100% 免费开源文件管理器和代码编辑器 WordPress 插件在包括 6.5.7 版本在内的所有版本中均存在有限制 JavaScript 文件上传漏洞。这是由于对允许的文件类型缺乏适当的检查。这使得经过身份验证的攻击者（具有订阅者及以上访问权限，并获得管理员授予的权限）能够上传 .css 和...

CVE-2026-17542

The CVE concerns the File Manager WordPress plugin before 6.9.1. One of its file manager connector endpoints lacks a capability check, allowing any authenticated user (e.g., a subscriber) to browse the entire WordPress installation directory and download files of certain types (archives and docum...

CVE-2026-17541

The CVE-2026-17541 affects the WordPress File Manager plugin prior to version 6.9.1. A REST API route lacks authorization checks, enabling unauthenticated users to read the file activity log and reveal file operations, involved paths, and the performing user. Documents confirm the vulnerability a...

CVE-2026-17541 Bit File Manager < 6.9.1 - Unauthenticated File Activity Log Disclosure

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them...

CVE-2026-17540

The CVE describes a vulnerability in the WordPress File Manager plugin prior to version 6.9.1. The issue is improper authorization of file management commands, allowing any authenticated user (e.g., a subscriber) to read and delete arbitrary files under the WordPress installation directory. This ...

CVE-2026-17540 Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's...

Exploit for Code Injection in Bitapps File_Manager

CVE-2024-7627 — Bit File Manager WordPress Unauthenticated R...

EUVD-2022-50359

Malicious code in bioql PyPI...

EUVD-2025-16714

Malicious code in bioql PyPI...

WordPress Bit File Manager plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Bit File Manager plugin, which stems from insufficient input cleanup and escaping during SVG file uploads, and no...

CVE-2025-1725

The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-1725

The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-1725 Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Uploads

The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-1725 Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Uploads

The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-1725

CVE-2025-1725 concerns the WordPress Bit File Manager plugin, vulnerable to a Stored Cross-Site Scripting (XSS) via SVG uploads in all versions up to and including 6.7. The root cause is insufficient input sanitization and output escaping during SVG file handling. Exploitation requires authentica...

WordPress plugin Bit File Manager 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Bit File Manager plugin, which stems from insufficient input cleanup and escaping during SVG file uploads, and no...

PT-2025-23590 · Unknown · Bit File Manager

Name of the Vulnerable Software and Affected Versions: The Bit File Manager versions up to, and including, 6.7 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

CVE-2024-8743

The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 6.5.7. This is due to a lack of proper checks on allowed file types. This makes it possible for...