CVE-2025-34085-Multi-target

CVE-2025-34085 Escáner RCE Multiobjetivo Escáner de explotación masiva para CVE-2025-34085 — una vulnerabilidad de ejecución remota de código no autenticada en el plugin Simple File List de WordPress. Esta herramienta sube un payload PHP disfrazado como imagen, lo renombra mediante un motor de...

CVE-2026-58048-PoC-Exploit

💥 CVE‑2026‑58048 – Kit de ejecución SQL como root en cPanel ⚠️ SOLO USO ÉTICO – PRUEBAS DE SEGURIDAD AUTORIZADAS Este repositorio proporciona herramientas únicamente para profesionales de seguridad autorizados, equipos azules y testers de penetración. El acceso no autorizado a sistemas informático...

delete-self-poc

🗑️ delete-self-poc El delete-self-poc es una demostración de un método para eliminar un ejecutable bloqueado o un archivo actualmente en ejecución del disco. Este concepto fue descubierto inicialmente por Jonas Lykkegaard, y yo he creado la prueba de concepto POC para el mismo. Además, puede...

auto_re

AutoRE Features 1. Auto-renaming dummy-named functions, which have one API call or jump to the imported API Before After 2. Assigning TAGS to functions accordingly to called API-indicators inside Sets tags as repeatable function comments and displays TAG tree in the separate view Some screenshots...

auto_re

AutoRE 特性 1. 自动重命名只有一个API调用或跳转到导入的API的虚拟函数 之前 之后 2. 根据内部调用的API指示符为函数分配TAGS 将标签设置为可重复的函数注释，并在单独的视图中显示标签树 TAGS视图的一些截图： TAG在未探索代码中的显示： 您可以使用右键菜单或按 n 快捷键轻松重命名函数： 安装 只需将 autore.py 复制到 IDA\plugins 目录，然后通过 Edit - Plugins - Auto RE 菜单即可使用。...

CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV

Executive summary macOS Music and TV do an insecure rename resulting in FDA by gaining full control over the user's TCC.db I reported this bug in separate tickets for each app, feel free to merge if applicable. The underlying problem is that these apps have FDA but fail to sanitize their file...

Frontend File Manager < 21.3 - Unauthenticated File Renaming

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server id:...

CVE-2026-92247

SynaptikCMS File Manager — RCE Autenticado Vulnerabilidad Ejecución Remota de Código Autenticada en el Gestor de Archivos de SynaptikCMS El gestor de archivos de SynaptikCMS permite a un atacante autenticado subir un archivo y posteriormente renombrarlo a un archivo PHP. Este comportamiento de...

CVE-2025-34085

📂 Simple File List – Exploit RCE no autenticado CVE-2025-34085 ⚠️ Código de exploit por: Mrj Haxcore Un exploit Python completamente funcional para el plugin Simple File List de WordPress = 4.2.3, el cual es vulnerable a ejecución remota de código no autenticada RCE debido a una lógica insegura de...

CVE-2025-34085

Cyberlone Indonesia 🛠️ Escáner de RCE de WordPress Simple File List + Limpieza Automática Herramienta automática para detectar y explotar Remote Code Execution RCE no autenticado en el plugin WordPress Simple File List , especialmente vulnerable a CVE-2025-34085. Equipado con un sistema de limpiez...

CVE-2026-92247

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

CVE-2026-92247 synaptikcms synaptik-cms Admin File Manager file-manager.php rename unrestricted upload

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

CVE-2026-92247

CVE-2026-92247 affects synaptik-cms up to version 1.3.4.4 . The vulnerability resides in the rename function of admin/file-manager.php within the Admin File Manager component, where manipulation of this function leads to unrestricted upload of files. The attack can be initiated remotely but requi...

EUVD-2026-80091

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

CVE-2026-92247 synaptikcms synaptik-cms Admin File Manager file-manager.php rename unrestricted upload

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

CVE-2026-18423

Concrete CMS versions 9.0.0 through 9.5.2 contain an Insecure Direct Object Reference (IDOR) flaw in the Express saved search preset delete and edit dialogs. An authenticated user holding only view permission on a single Express entity could permanently delete (no undo) or rename saved search pre...

rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options

A flaw was found in rsync. A remote attacker can exploit this vulnerability by specifying an absolute path using the --temp-dir or --link-dest options. This bypasses the rename-confinement logic, allowing the attacker to write files to arbitrary locations outside the intended destination tree,...

rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options

A flaw was found in rsync. A remote attacker can exploit this vulnerability by specifying an absolute path using the --temp-dir or --link-dest options. This bypasses the rename-confinement logic, allowing the attacker to write files to arbitrary locations outside the intended destination tree,...

CVE-2026-59178

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

CVE-2026-59178 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...