CVE-2026-80209

The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSIONDENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but it does not return. Execution continues...

EUVD-2026-67143

The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSIONDENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but it does not return. Execution continues...

CVE-2026-80209 Fonoster through 0.22.7 Incorrect Authorization in the Identity UpdateWorkspace Handler

The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSIONDENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but it does not return. Execution continues...

CVE-2026-80209

Fonoster through version 0.22.7 contains an incorrect authorization flaw in the updateWorkspace handler (mods/identity/src/workspaces/createUpdateWorkspace.ts). The handler fires a gRPC PERMISSION_DENIED callback when the caller is not a workspace member but fails to return , allowing execution t...

POC-CVE-2026-58048

CVE-2026-58048 CVSS 4.0: 9.4 Kritisch | CWE-89: SQL Injection | NVD Authentifizierter cPanel-Benutzer → beliebiges SQL als MySQL-Root über Datenbank-Umbenennung. cPanel behält die Sitzungs-sqlmode des Benutzers ANSIQUOTES fälschlicherweise bei, wenn Umbenennungsvorgänge als Root ausgeführt werden...

Frontend File Manager < 21.3 - Unauthenticated File Renaming

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server id:...

CVE-2025-34085

📂 Simple File List – 未认证的远程代码执行漏洞利用 CVE-2025-34085 ⚠️ 漏洞利用代码作者：Mrj Haxcore 一个针对 WordPress Simple File List 插件 = 4.2.3 的完整 Python 漏洞利用脚本，该插件因不安全的文件上传和重命名逻辑而存在未认证的远程代码执行 RCE 漏洞。 💣 漏洞摘要 插件 ：Simple File List simple-file-list 版本 ：= 4.2.3 CVE ：CVE-2025-34085 影响 ：未认证用户可上传伪装成 .png 的 PHP 文件，随后将其重命名为 .php...

CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV

Riepilogo esecutivo macOS Music e TV eseguono un rename insicuro che porta a FDA ottenendo il pieno controllo sul TCC.db dell'utente Ho segnalato questo bug in ticket separati per ciascuna app, sentitevi liberi di unirli se applicabile. Il problema di fondo è che queste app hanno FDA ma non...

CVE-2024-44871

MoziloCMS = 3.0.1 인증된 RCE 설명 이 스크립트는 MoziloCMS를 실행하는 웹 애플리케이션 테스트를 위해 설계된 익스플로잇 도구입니다. 공격자가 관리자 로그인을 사용하여 jpg 파일을 통해 PHP 웹 셸을 업로드하고, 업로드된 파일의 이름을 php로 변경한 다음, 해당 php 파일을 통해 대상에 시스템 명령을 전송할 수 있게 해줍니다. ⚠️ 경고: 이 스크립트는 교육 목적으로만 사용됩니다. 책임감 있게 사용하고 시스템을 테스트하기 전에 적절한 권한이 있는지 확인하십시오. 무단 사용은 불법이며 비윤리적입니다...

CVE-2025-34085-Multi-target

CVE-2025-34085 Scanner RCE multi-target Scanner per lo sfruttamento di massa di CVE-2025-34085 — una vulnerabilità di esecuzione remota di codice non autenticata nel plugin WordPress Simple File List. Questo strumento carica un payload PHP camuffato da immagine, lo rinomina tramite un motore di...

CVE-2026-65891

CVE-2026-65891 — Joomla JCE Rename PoC Scanner proof-of-concept per CVE-2026-65891 nell'estensione Joomla Content Editor JCE. La convalida inadeguata dell'input nella funzione rename del file manager JCE consente a un utente autenticato con permessi di gestione file di: creare file nascosti nomi...

CVE-2026-37071

CVE-2026-37071 affects Veno File Manager Project 4.4.9 in the Actions::renameFile() function. An authenticated attacker holding the 'reanme' permission can send a specially crafted POST request that renames the application configuration file, triggering a configuration rebuild that resets super a...

CVE-2025-34085

Cyberlone Indonesia 🛠️ WordPress Simple File List RCE Scanner + Auto-Clean Strumento automatico per rilevare e sfruttare l'Remote Code Execution RCE non autenticata nel plugin WordPress Simple File List , in particolare quelli vulnerabili a CVE-2025-34085. Dotato di un sistema di pulizia automatic...

CVE-2026-37071

CVE-2026-37071 Beliebige Dateiumbenennung führend zur Erhöhung von Berechtigungen in der Funktion Actions::renameFile im Veno File Manager Project 4.4.9 ermöglicht es einem authentifizierten Angreifer mit der Berechtigung 'reanme', das Superadministratorkonto zu übernehmen, indem er eine speziell...

auto_re

AutoRE सुविधाएँ 1. डमी-नामित फ़ंक्शनों का ऑटो-रीनेमिंग, जिनमें एक API कॉल या आयातित API पर जंप होता है पहले बाद में 2. कॉल किए गए API-इंडिकेटर के अनुसार फ़ंक्शनों को TAGS असाइन करना टैग को दोहराए जाने वाले फ़ंक्शन कमेंट के रूप में सेट करता है और एक अलग व्यू में TAG ट्री प्रदर्शित करता है TAGS...

CVE-2025-23968

AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o Das AI Bud Plugin stellt einen REST-API-Endpunkt /wp-json/ai-buddy/v1/wp/attachments bereit, der das Hochladen von Dateien in die WordPress-Mediathek ermöglicht. Die Dateilogik des Endpunkts enthält eine Dateiumbenennungsfunktion,...

auto_re

AutoRE Features 1. Auto-renaming dummy-named functions, which have one API call or jump to the imported API Before After 2. Assigning TAGS to functions accordingly to called API-indicators inside Sets tags as repeatable function comments and displays TAG tree in the separate view Some screenshots...

CVE-2025-34085

CVE-2025-34085 — Exploit für nicht authentifizierte Remote-Codeausführung in WordPress Simple File List Ein automatisierter Exploit und Scanner für CVE-2025-34085 , eine kritische Schwachstelle im WordPress Simple File List Plugin, die nicht authentifizierte Remote-Codeausführung durch...

laravel-filemanager-unrestricted-upload

Laravel FileManager Unrestricted File Upload CVE-2025-56399 CWE-434: Uneingeschränkter Upload von Dateien mit gefährlichem Typ CVSS-Score: 8.5 Hoch 📋 Beschreibung Dieses Tool bietet einen Proof of Concept PoC für CVE-2025-56399 , eine kritische Schwachstelle in alexusmai/laravel-file-manager...

CVE-2026-53528

LeafWiki is a self-hosted wiki. Versions 0.3.0 through 0.10.0 have a path traversal vulnerability in LeafWiki’s asset rename functionality. An authenticated user with editor permissions could move files that are accessible to the LeafWiki server process into a page’s asset directory. This could...