delete-self-poc

🗑️ delete-self-poc delete-self-poc 演示了一种从磁盘删除被锁定或当前正在运行的文件的方法。此概念最初由 Jonas Lykkegaard 发现，我为此创建了概念验证（POC）。此外，只要当前调用进程具有访问和删除这些文件的必要权限，它也可以用于删除磁盘上被锁定的文件。 那么这个 POC 是如何工作的呢？ 1. 打开当前运行进程的 HANDLE，并具有 DELETE 访问权限。请注意，仅需要 DELETE 访问权限。 2. 使用 SetFileInformationByHandle 函数将主文件流 :$DATA 重命名为 :wtfbbq。 3. 关闭...

auto_re

AutoRE Features 1. Auto-renaming dummy-named functions, which have one API call or jump to the imported API Before After 2. Assigning TAGS to functions accordingly to called API-indicators inside Sets tags as repeatable function comments and displays TAG tree in the separate view Some screenshots...

auto_re

AutoRE 機能 1. ダミー名の関数の自動リネーム（API呼び出しまたはインポートされたAPIへのジャンプが1つあるもの） 変更前 変更後 2. 関数内で呼び出されたAPIインジケータに応じてTAGSを割り当て タグを繰り返し可能な関数コメントとして設定し、別ビューにTAGツリーを表示 TAGSビューのスクリーンショット： TAGsが未探索コードでどのように見えるか： 関数のコンテキストメニューを使用するか、nホットキーを押すだけで簡単に関数名を変更できます： インストール autore.pyをIDA\pluginsディレクトリにコピーするだけで、Edit - Plugins -...

CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV

执行摘要 macOS 的 Music 和 TV 存在不安全的重命名操作，导致通过完全控制用户的 TCC.db 来获得 FDA。 我针对每个应用分别提交了漏洞报告，如果适用，可以合并。 根本问题在于这些应用拥有 FDA 权限，但未能对其文件操作进行清理。 利用描述 Music 和 TV 在这方面几乎相同，只是路径不同。此后我将以 Music 为例。TV 的利用代码非常直接，请自行查看。 Music 具有将文件复制到用户资料库的功能，该功能通过一个专用文件夹实现，用户可以在此文件夹中“拖放”文件。 用户只需在 /Music/Music/Media.localized/Automaticall...

Frontend File Manager < 21.3 - Unauthenticated File Renaming

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server id:...

CVE-2026-92247

SynaptikCMS 文件管理器 — 认证后远程代码执行 漏洞 SynaptikCMS 文件管理器认证后远程代码执行 SynaptikCMS 的文件管理器允许已认证的攻击者上传文件，随后将其重命名为 PHP 文件。这种上传和重命名行为可被滥用来将可执行的 PHP 代码放置到 Web 可访问的位置，从而导致在 Web 服务器上下文中执行远程代码。 研究员： D1n3sh 受影响组件 root@kitploit: /admin/file-manager.php 存在漏洞的功能涉及文件上传和文件重命名操作。 漏洞类型 不受限制的文件上传 文件扩展名 / 重命名验证绕过 认证后远程代码执行...

CVE-2025-34085

📂 Simple File List – Exploit RCE no autenticado CVE-2025-34085 ⚠️ Código de exploit por: Mrj Haxcore Un exploit Python completamente funcional para el plugin Simple File List de WordPress = 4.2.3, el cual es vulnerable a ejecución remota de código no autenticada RCE debido a una lógica insegura de...

CVE-2026-58048-PoC-Exploit

💥 CVE‑2026‑58048 – cPanel Root SQL 执行工具包 ⚠️ 仅限道德用途 – 授权安全测试 本仓库仅为授权安全专业人员、蓝队和渗透测试人员 提供工具。 未经授权访问计算机系统在 CFAA（美国）、Computer Misuse Act（英国）、TCK 243/244（土耳其）以及全球类似法律 下均属违法行为。 📖 漏洞概述 CVE‑2026‑58048 是 cPanel & WHM 11.x 版本中的一个严重 SQL 注入漏洞，允许已认证的 cPanel 用户通过数据库重命名功能以 MySQL root 权限 执行任意 SQL 命令。 工作原理 1...

CVE-2025-34085

Cyberlone Indonesia 🛠️ Escáner de RCE de WordPress Simple File List + Limpieza Automática Herramienta automática para detectar y explotar Remote Code Execution RCE no autenticado en el plugin WordPress Simple File List , especialmente vulnerable a CVE-2025-34085. Equipado con un sistema de limpiez...

CVE-2026-92247

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

CVE-2026-92247 synaptikcms synaptik-cms Admin File Manager file-manager.php rename unrestricted upload

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

CVE-2026-92247

CVE-2026-92247 affects synaptik-cms up to version 1.3.4.4 . The vulnerability resides in the rename function of admin/file-manager.php within the Admin File Manager component, where manipulation of this function leads to unrestricted upload of files. The attack can be initiated remotely but requi...

EUVD-2026-80091

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

CVE-2025-34085-Multi-target

CVE-2025-34085 Multi-Target RCE Scanner Mass-exploitation scanner for CVE-2025-34085 — an unauthenticated remote code execution vulnerability in the WordPress Simple File List plugin. This tool uploads a PHP payload disguised as an image, renames it via a vulnerable file engine, and triggers shel...

CVE-2026-18423

Concrete CMS versions 9.0.0 through 9.5.2 contain an Insecure Direct Object Reference (IDOR) flaw in the Express saved search preset delete and edit dialogs. An authenticated user holding only view permission on a single Express entity could permanently delete (no undo) or rename saved search pre...

rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options

A flaw was found in rsync. A remote attacker can exploit this vulnerability by specifying an absolute path using the --temp-dir or --link-dest options. This bypasses the rename-confinement logic, allowing the attacker to write files to arbitrary locations outside the intended destination tree,...

rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options

A flaw was found in rsync. A remote attacker can exploit this vulnerability by specifying an absolute path using the --temp-dir or --link-dest options. This bypasses the rename-confinement logic, allowing the attacker to write files to arbitrary locations outside the intended destination tree,...

CVE-2026-59178

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

CVE-2026-59178 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

CVE-2026-59178

ESPHome Device Builder Dashboard prior to version 1.0.12 silently loses dashboard authentication after an upgrade. The root cause is that authentication credentials were read from $USERNAME/$PASSWORD in earlier versions, but after being renamed to $ESPHOME_USERNAME/$ESPHOME_PASSWORD, the bare nam...