CVE-2026-92247

SynaptikCMS File Manager — Authenticated RCE Vulnerability SynaptikCMS File Manager Authenticated Remote Code Execution SynaptikCMS's file manager allows an authenticated attacker to upload a file and subsequently rename it to a PHP file. This upload and rename behavior can be abused to place...

PT-2026-104059

Name of the Vulnerable Software and Affected Versions ClipBucket versions 5 through 5.5.3-197 Description Authenticated users with ad manager access permission can perform SQL injection via the delete parameter in the 'admin area/ads manager.php' endpoint. By using time-based blind payloads...

PT-2026-98878

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.4.0 Description The application fails to perform numeric validation on dimension width, height, ratio, and filesize values provided via the Batch Manager filter URL in the 'admin/batch manager.php' endpoint. These...

CVE-2026-92247 synaptikcms synaptik-cms Admin File Manager file-manager.php rename unrestricted upload

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

CVE-2025-65474: Use of Incorrectly-Resolved Name or Reference

An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via renaming a PHP file to a SVG format...

CVE-2025-65471: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via uploading a crafted PHP file...

PT-2025-19805 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 13.3 Description: A SQL injection issue was discovered in the admin manager.php component. Recommendations: For SeaCMS version 13.3, update to a version that fixes the SQL injection vulnerability in the admin manager.php...

Information Disclosure

moodle/moodle is vulnerable to information disclosure. The vulnerability exists because the activity attempts report does not properly filter by groups in the getreport function of manager.php, allowing an attacker to reveal the information about attempts or users in groups to non-editing teacher...

PT-2022-8598

Name of the Vulnerable Software and Affected Versions piwigo version 2.9.5 Description The issue is related to a SQL Injection vulnerability in the admin/batch manager.php file, specifically via the filter category parameter to the "admin.php?page=batch manager" endpoint. This vulnerability can b...

Remote Code Execution (RCE)

laravel/laravel is vulnerable to remote code execution. The vulnerability exists in destruct in PendingResourceRegistration.php, Manager.php, and ClosureWrapper.php which allows an attacker is able to inject malicious code via an unserialize pop chain...

PT-2021-23509

Name of the Vulnerable Software and Affected Versions PHP Event Calendar versions prior to 2021-09-03 Description The issue allows SQL injection, as demonstrated by the "/server/ajax/user manager.php" endpoint, specifically the username parameter. This can be used to execute SQL statements direct...

PT-2021-23510

Name of the Vulnerable Software and Affected Versions PHP Event Calendar through 2021-11-04 Description The issue allows for persistent cross-site scripting XSS and can be exploited by an adversary in multiple ways, such as performing actions on the page in the context of other users or defacing...

PT-2021-11583

Name of the Vulnerable Software and Affected Versions: SeaCMS version 10.7 Description: A Cross Site Request Forgery CSRF issue exists in the admin manager.php file, which could allow a malicious user to add an admin account. This could potentially lead to unauthorized access and control of the...

PT-2021-11641

Name of the Vulnerable Software and Affected Versions: food-and-drink-menu plugin through 2.2.0 for WordPress Description: The issue allows remote attackers to execute arbitrary code because of an unserialize operation on the fdm cart cookie in load cart from cookie in...

CVE-2020-29045: Deserialization of Untrusted Data

The food-and-drink-menu plugin through 2.2.0 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the fdmcart cookie in loadcartfromcookie in includes/class-cart-manager.php...

CVE-2021-3311

An issue was discovered in October through build 471. It reactivates an old session ID which had been invalid after a logout once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant if an old session ID is known to an...

CVE-2021-3311: Insufficient Session Expiration

An issue was discovered in October through build 471. It reactivates an old session ID which had been invalid after a logout once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant if an old session ID is known to an...

SEOPanel 4.6.0 Cross Site Scripting

Hello, We are informing you about Cross-Site Scripting Vulnerabilities in SEOPanel 4.6.0. Information -------------------- Advisory by Netsparker Name: Cross-Site Scripting Vulnerabilities in SEOPanel Affected Software: SEOPanel Affected Versions: 4.6.0 Vendor Homepage: https://www.seopanel.org/...

PT-2020-7390

Name of the Vulnerable Software and Affected Versions: SimpleHRM versions 2.3 and earlier Description: The issue allows remote attackers to bypass the authentication process in the 'user manager.php' file by spoofing a cookie. Recommendations: For SimpleHRM versions 2.3 and earlier, update to a...

CVE-2011-1135: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in plugins/ExtendedFileManager/manager.php and plugins/ImageManager/manager.php...