Simple File List < 6.1.13 - Reflected Cross-Site Scripting

Simple File List WordPress plugin \u003C 6.1.13 contains a reflected cross-site scripting caused by unsanitized URL output in an attribute, letting attackers execute malicious scripts in admin browsers, exploit requires victim to be an admin. id: CVE-2024-10146 info: name: Simple File List 6.1.13...

WordPress Simple File List - Path Traversal

Simple File List plugin allows path traversal via file upload, enabling files to be written outside the upload directory. id: CVE-2020-12832 info: name: WordPress Simple File List - Path Traversal author: riteshs4hu severity: critical description: | Simple File List plugin allows path traversal v...

Simple File List < 4.4.12 - Cross Site Scripting

The plugin does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting id: CVE-2022-3062 info: name: Simple File List 4.4.12 - Cross Site Scripting author: r3Y3r53 severity: medium description: | The plugin does not escape parameters before...

CVE-2025-34085-Multi-target

CVE-2025-34085 Multi-Target RCE Scanner Mass-exploitation scanner for CVE-2025-34085 — an unauthenticated remote code execution vulnerability in the WordPress Simple File List plugin. This tool uploads a PHP payload disguised as an image, renames it via a vulnerable file engine, and triggers shel...

simple-file-list-rce

simple-file-list-rce Simple File List 4.2.3 - Unauthenticated Arbitrary File Upload RCE usage: simple.py -h -u URL -f1 FILE1 -f2 FILE2 -p PATH optional arguments: -h, --help show this help message and exit -u URL, --url URL Wordpress Url i.e https://wordpress.lan -f1 FILE1, --file1 FILE1 Harmless...

PT-2026-104148

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file list' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2025-34085

📂 Simple File List – Unauthenticated RCE Exploit CVE-2025-34085 ⚠️ Exploit Code by: Mrj Haxcore A fully working Python exploit for the WordPress Simple File List plugin = 4.2.3, which is vulnerable to unauthenticated remote code execution RCE due to insecure file upload and rename logic. 💣...

CVE-2022-1119

CVE-2022-1119 1.Introduction WordPress Simple File List 3.2.8 FileRead POC 2.Usage poc -f host.txt // Batch scan poc -h 192.168.1.1 // Single scan 3.Disclaimer This tool is only for learning, research, and self-assessment. It should not be used for illegal purposes. Please comply with relevant la...

CVE-2025-34085

Cyberlone Indonesia 🛠️ WordPress Simple File List RCE Scanner + Auto-Clean Automated tool to detect and exploit unauthenticated Remote Code Execution RCE on the WordPress Simple File List plugin, specifically those vulnerable to CVE-2025-34085. Equipped with an automatic target cleaning system and...

CVE-2025-34085

CVE-2025-34085 — WordPress Simple File List Unauthenticated RCE An automated exploit for CVE-2025-34085 duplicate of CVE-2020-36847, a critical unauthenticated remote code execution vulnerability in the WordPress Simple File List plugin versions ≤ 4.2.2. Note: CVE-2025-34085 was rejected by MITRE...

CVE-2025-34085

CVE-2025-34085 — WordPress Simple File List Unauthenticated RCE Exploit An automated exploit and scanner for CVE-2025-34085 , a critical vulnerability in the WordPress Simple File List plugin, enabling unauthenticated remote code execution through arbitrary file upload and rename functionalities....

By-Poloss..-..CVE-2026-11912

CVE-2026-11912: Simple File List eeListSettings'AllowFrontManage' != 'YES' return;...

rsync: rsync: Arbitrary file deletion via malicious file list

An improper path handling vulnerability in rsync allows a remote attacker to delete arbitrary files on the receiving system. By sending a specially crafted file list during synchronization, an attacker can expand the scope of --delete operations beyond the target directory, potentially causing a...

rsync: rsync: Denial of Service via Algorithmic Complexity

A flaw was found in rsync. A remote attacker can exploit an algorithmic complexity vulnerability within the hashsearch function by sending a specially crafted file list. This can lead to the exhaustion of the receiver's CPU resources, causing a sustained denial of service DoS...

rsync: rsync: Arbitrary file deletion via malicious file list

An improper path handling vulnerability in rsync allows a remote attacker to delete arbitrary files on the receiving system. By sending a specially crafted file list during synchronization, an attacker can expand the scope of --delete operations beyond the target directory, potentially causing a...

CVE-2026-70459

A flaw was found in rsync. A remote attacker could send a specially crafted file list to the rsync daemon. This could lead to a null pointer dereference, causing the daemon to crash and resulting in a Denial of Service DoS. Mitigation To mitigate this issue, restrict network access to the rsync...

SUSE CVE-2026-73509

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batchrename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPathreq.SrcDir and validates renameObject.NewName with checkRelativePath, but does not...

BIT-JOOMLA-2026-73373 Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260810 - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...

EUVD-2026-66343

CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists via specific functionality, resulting in partial information disclosure...

CVE-2026-80234

CAYIN CMS-WS and CMS-SE , developed by CAYIN Technology, are affected by a Missing Authentication vulnerability. An unauthenticated remote attacker can leverage a specific functionality to obtain media file lists , resulting in partial information disclosure . The CNA TW CERT assigned a CVSS 3.1 ...