xerteonlinetoolkits-rce

Xerte Online Toolkits '/readme.txt|.html|php|php5|php|phtml|phar|inc|py|pl|sh$/i', 'read' = false, php 正则表达式仅匹配前一个字符。因此它会匹配以下内容：“ph”、“php”、“phppp”等。 链式攻击向量复现步骤 未经身份验证的远程代码执行 如果启用了身份验证（这不是 Xerte 的默认配置），那么攻击者必须知道（或暴力破解出）有效用户的用户名。如果使用访客身份验证（默认），那么目标项目目录将只是 1--Nottingham。 未经身份验证的攻击者可以在任何 USER-FILES/...

elFinder < 2.1.58 - Remote Code Execution

studio-42/elfinder before 2.1.58 contains a remote code execution caused by execution of PHP code in a .phar file, letting attackers execute arbitrary PHP code if the server parses .phar files as PHP, exploit requires server to parse .phar files as PHP. id: CVE-2021-23394 info: name: elFinder...

Maian Cart <=3.8 - Remote Code Execution

Maian Cart 3.0 to 3.8 via the elFinder file manager plugin contains a remote code execution vulnerability. id: CVE-2021-32172 info: name: Maian Cart =3.8 to mitigate this vulnerability. reference: - https://dreyand.github.io/maian-cart-rce/ - https://github.com/DreyAnd/maian-cart-rce -...

Studio-42 elFinder <2.1.60 - Arbitrary File Upload

Studio-42 elFinder 2.0.4 to 2.1.59 is vulnerable to unauthenticated file upload via connector.minimal.php which could allow a remote user to upload arbitrary files and execute PHP code. id: CVE-2021-43421 info: name: Studio-42 elFinder 2.1.60 - Arbitrary File Upload author: akincibor severity:...

Xerte Online Toolkits <= 3.15 - Remote Code Execution

Xerte Online Toolkits versions 3.15 and earlier expose the elFinder file manager connector at /editor/elfinder/php/connector.php without authentication CVE-2026-34413, because the access-control redirect for unauthenticated users does not call exit/die and execution continues server-side. This is...

elFinder <=2.1.60 - Local File Inclusion

elFinder through 2.1.60 is affected by local file inclusion via connector.minimal.php. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths. id: CVE-2022-26960 info: name: elFind...

CVE-2023-35840

CVE-2023-35840 elFinder 2.1.62 - PHP LocalVolumeDriver 连接器中的路径遍历漏洞 描述 PHP LocalVolumeDriver 连接器中存在路径遍历漏洞。此漏洞可被利用，允许不受信任的用户向本地文件系统写入数据。 该漏洞存在于 target 参数中，该参数包含一个 base64 编码的路径。例如，路径 pentest 被编码为： root@kitploit: 1cGVudGVzdA== 如果忽略 l1（它看起来是一个常量前缀），其余部分可以解码为： root@kitploit: pentest 因此，我们可以将其修改为：...

wp-file-manager-0day

CVE-2020-25213 wp-file-manager 6.7 20 de agosto de 2020 Plugin 0day de Wordpress La vulnerabilidad de elFinder es una vulnerabilidad bien conocida, mi script solo cambia la ruta a "/wp-content/plugins/wp-file-manager/". Deja de pedirme correcciones en el script o cualquier otra cosa. RTFM...

CVE-2019-9194-elFinder-Command-Injection-PoC

CVE-2019-9194 — elFinder 命令注入 PoC elFinder = 2.1.47 中通过 PHP 连接器组件存在的命令注入漏洞。允许未经身份验证的远程攻击者以 Web 服务器用户的身份执行任意代码。 工作原理 上传一个带有恶意文件名的有效 JPEG 文件，文件名中包含 shell 命令。 通过请求图像旋转触发漏洞，该操作将文件名未经清理地传递给 exiftran。 注入的命令将 PHP webshell SecSignal.php 写入服务器。 连接到 webshell 并进入交互式 shell。 使用要求 Python 3 requests 库 pip insta...

elFinder 2.1.58 - Remote Code Execution

elFinder 2.1.58 is impacted by multiple remote code execution vulnerabilities that could allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. id: CVE-2021-32682 info: name: elFinder 2.1.58 - Remote Code Executi...

CVE-2021-23394

Configuración de Reproducción de elFinder CVE-2021-23394 Este repositorio contiene una configuración de reproducción para CVE-2021-23394 Ejecución Arbitraria de Archivos en elFinder usando Docker. Configura cuatro entornos para comparar versiones vulnerables y parcheadas en Apache y Nginx. Resume...

Python-CVE-2020-25213

Python-CVE-2020-25213 用于 WP File Manager 漏洞的 Python 交互式利用工具。WordPress 的 File Manager wp-file-manager 插件 6.9 版本之前允许远程攻击者上传并执行任意 PHP 代码，因为它将一个不安全的示例 elFinder 连接器文件重命名为 .php 扩展名。 该脚本使用 argparse、requests、re、sys、os、json 和 random Python 模块。 要通过 pip 安装这些模块，请在命令行中执行以下命令： root@kitploit: pip install -r...

Python-exploit-CVE-2020-25213

Descripción El plugin File Manager wp-file-manager anterior a la versión 6.9 para WordPress permite a atacantes remotos cargar y ejecutar código PHP arbitrario porque renombra un archivo de conector elFinder de ejemplo inseguro para que tenga la extensión .php. Esto, por ejemplo, permite a los...

elFinder <= 2.1.47 - Command Injection

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector. The vulnerability occurs when performing image operations on JPEG files, where the filename is passed to the exiftran utility without proper sanitization, allowing command injection. id: CVE-2019-9194 info: name:...

CVE-2026-81891

creationtimestamp| type| source ---|---|--- 2026-09-02 16:35:35+00:00| published-proof-of-concept| https://github.com/Studio-42/elFinder/security/advisories/GHSA-gxmj-r5rf-ggwq 2026-09-04 00:05:19+00:00| seen| https://bsky.app/profile/opsmatters.com/post/3muno52zkqz23 2026-09-08 03:44:17+00:00|...

EUVD-2026-68800

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload RCE...

GHSA-GXMJ-R5RF-GGWQ elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...

EUVD-2026-68772

elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections...

CVE-2026-81889

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...