CVE-2019-1315

Windows Error Reporting Manager arbitrary file move Elevation of Privilege Details: https://offsec.almond.consulting/windows-error-reporting-arbitrary-file-move-eop.html You will need the NtApiDotNet library to run it, as well as a valid Report.wer file, both to be placed in the same directory as...

MoveEdr

MoveEDR 管理者であれば、ブート直後でサービスが開始される前に、Windows にフォルダやファイルの削除・移動を強制させることができます。これは EDR を無効化するために利用できます。 使い方 !CAUTION CrowdStrike には問題があり、「INACCESSIBLEBOOTDEVICE」というメッセージが表示されてブートループに陥ります。 私の推測では、CrowdStrike 自体かソフトウェア展開ソリューションが、欠落した CrowdStrike ファイルをインストールしようとするものの失敗し、壊れた状態のまま残してしまうのだと思います。...

parallels-file-move-privesc

parallels-file-move-privesc This repository contains an exploit for CVE-2023-50226 / ZDI-CAN-21227, which can be used to escalate privileges to root using Parallels Desktop on versions before 18.3.2...

SysTracingPoc

SysTracingPoc CVE-2020-0668 - Microsoft Windows Service Tracing Arbitrary File Move Local Privilege Escalation Vulnerability For more information: https://itm4n.github.io/cve-2020-0668-windows-service-tracing-eop/...

CVE-2020-0668

CVE-2020-0668 Use CVE-2020-0668 to perform an arbitrary privileged file move operation. Use https://github.com/itm4n/UsoDllLoader Windows = 1903 OR https://github.com/xct/diaghub Windows 1903 for privilege escalation. Demo Links & Resources...

RazerEoP

RazerEoP Razer Synapse 3 Macroモジュールにおける任意のファイル削除/移動のPoCです。 このモジュールを使用すると、ユーザーは作成したマクロをディスク上のファイルにエクスポートでき、ファイル操作はnt authority\systemとして実行されるRazerサービスを介して行われます。 この問題をRazerのバグバウンティプログラムを通じて報告しようとしましたが、これはバグではなくエクスプロイトであるという返答を受け取りました 🤣。 その後、HackerOneにも報告しましたが、報告が古いことを理由にInformativeとしてクローズされました。...

CVE-2024-21111

CVE-2024-21111 Oracle VirtualBox Prior to 7.0.16 is vulnerable to Local Privilege Escalation via Symbolic Link Following leading to Arbitrary File Delete and Arbitrary File Move. VirtualBox attempts to move log files as NT AUTHORITY\SYSTEM in C:\ProgramData\VirtualBox which all users can write to...

WordPress WP Travel Engine plugin < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image vulnerability

Subscriber+ Arbitrary Media File Move via userprofileimage vulnerability discovered by marim00 in WordPress Plugin WP Travel Engine versions 6.8.1...

CVE-2026-64838

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

CVE-2026-64838 ICEcoder through 8.1 Path Traversal via oldFileName Parameter

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

CVE-2026-64838: Improper Limitation of a Pathname to a Restricted Directory

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

CVE-2026-77757

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...

EUVD-2026-66287

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...

CVE-2026-77757 Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...

CVE-2026-77757

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin (versions 8.5-8.9.2 ) is vulnerable to an arbitrary image move flaw. The root cause is a failure to sanitize user-supplied image references when used as a source for a file move operation, specifically duri...

CVE-2026-77757 Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...

PT-2026-81967

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...

CVE-2026-77757: Improper Limitation of a Pathname to a Restricted Directory

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...

WordPress Simple File List plugin <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal vulnerability

Unauthenticated Arbitrary File Read and Move via Path Traversal vulnerability discovered by Sanjar Tulkinov in WordPress Plugin Simple File List versions = 6.3.11...

CVE-2026-16616 Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure a...