CVE-2026-64838

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

EUVD-2026-75455

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

CVE-2026-64838 ICEcoder through 8.1 Path Traversal via oldFileName Parameter

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

CVE-2026-64838

ICEcoder (a web-based code editor) versions through 8.1 are affected by a path traversal vulnerability in the oldFileName parameter used during file move and rename operations. Because the parameter is not properly validated, an authenticated attacker can inject path traversal sequences to reloca...

PT-2026-89419

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

CVE-2026-53528

LeafWiki (a self-hosted wiki) versions 0.3.0 through 0.10.0 contain a path traversal vulnerability in the asset rename functionality (RenameAsset via unsanitized oldFilename parameter). An authenticated user with editor permissions can move files accessible to the LeafWiki server process into a p...

CVE-2026-53528 FileWiki has path traversal in RenameAsset via unsanitized oldFilename parameter

LeafWiki is a self-hosted wiki. Versions 0.3.0 through 0.10.0 have a path traversal vulnerability in LeafWiki’s asset rename functionality. An authenticated user with editor permissions could move files that are accessible to the LeafWiki server process into a page’s asset directory. This could...

CVE-2025-15430

A vulnerability was detected in UTT 进取 512W 1.7.7-171114. Affected by this issue is the function strcpy of the file /goform/formFtpServerShareDirSelcet. Performing a manipulation of the argument oldfilename results in buffer overflow. The attack can be initiated remotely. The exploit is now publi...

CVE-2025-15430

CVE-2025-15430 affects UTT 进取 512W, version 1.7.7-171114. The root cause is a buffer overflow in the strcpy usage within /goform/formFtpServerShareDirSelcet caused by manipulation of the oldfilename argument. This leads to a remote execution vulnerability with high impact (confidentiality/availab...

EUVD-2026-0706

A vulnerability was detected in UTT 进取 512W 1.7.7-171114. Affected by this issue is the function strcpy of the file /goform/formFtpServerShareDirSelcet. Performing manipulation of the argument oldfilename results in buffer overflow. The attack can be initiated remotely. The exploit is now public...

CVE-2025-15430 UTT 进取 512W formFtpServerShareDirSelcet strcpy buffer overflow

A vulnerability was detected in UTT 进取 512W 1.7.7-171114. Affected by this issue is the function strcpy of the file /goform/formFtpServerShareDirSelcet. Performing a manipulation of the argument oldfilename results in buffer overflow. The attack can be initiated remotely. The exploit is now publi...

PT-2026-1049

Name of the Vulnerable Software and Affected Versions UTT 进取 512W version 1.7.7-171114 Description A flaw exists in UTT 进取 512W 1.7.7-171114 that allows remote attackers to trigger a buffer overflow. The issue is located in the strcpy function within the /goform/formFtpServerShareDirSelcet file...

EUVD-2022-1179

Malicious code in bioql PyPI...

CVE-2021-46062

MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName...

CVE-2021-46062

MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName...

Arbitrary file deletion

MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName...

CVE-2021-46062

MCMS 5.2.5 is affected by an arbitrary file deletion vulnerability in the oldFileName handling. The issue arises from ms-basic

CVE-2021-46062

MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName...

MingSoft MCMS 安全漏洞

MingSoft MCMS is a complete open source J2ee system from MingSoft. A security vulnerability exists in MCMS, which was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName...

CVE-2018-9134

filemanagecontrol.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution. This uses the oldfilename and newfilename parameters...