CVE-2026-84367

joi (a JavaScript schema validator) is vulnerable to a limited prototype pollution via object().rename() in versions 16.0.0 through 17.13.4 and 18.2.3 . The root cause lies in internals.rename() in lib/types/keys.js: when a schema uses a regular-expression source combined with a Joi.expression() ...

CVE-2025-23968

AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o The AI Bud plugin exposes a REST API endpoint /wp-json/ai-buddy/v1/wp/attachments that allows uploading files to the WordPress media library. The endpoint’s file logic contains file renaming functionality that triggers after file...

auto_re

AutoRE Features 1. Auto-renaming dummy-named functions, which have one API call or jump to the imported API Before After 2. Assigning TAGS to functions accordingly to called API-indicators inside Sets tags as repeatable function comments and displays TAG tree in the separate view Some screenshots...

auto_re

AutoRE Funcionalidades 1. Renombrado automático de funciones con nombres ficticios, que tienen una llamada API o salto a la API importada Antes Después 2. Asignación de TAGS a las funciones según los indicadores de API llamados en su interior Establece los tags como comentarios de función...

CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV

Executive summary macOS Music and TV do an insecure rename resulting in FDA by gaining full control over the user's TCC.db I reported this bug in separate tickets for each app, feel free to merge if applicable. The underlying problem is that these apps have FDA but fail to sanitize their file...

POC-CVE-2026-58048

CVE-2026-58048 CVSS 4.0: 9.4 Critical | CWE-89: SQL Injection | NVD Authenticated cPanel user → arbitrary SQL as MySQL root via database rename. cPanel improperly preserves the user's session sqlmode ANSIQUOTES when executing rename operations as root — a backtick in the database name breaks out ...

Frontend File Manager < 21.3 - Unauthenticated File Renaming

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server id:...

CVE-2025-34085-Multi-target

CVE-2025-34085 Escáner RCE Multiobjetivo Escáner de explotación masiva para CVE-2025-34085 — una vulnerabilidad de ejecución remota de código no autenticada en el plugin Simple File List de WordPress. Esta herramienta sube un payload PHP disfrazado como imagen, lo renombra mediante un motor de...

CVE-2026-65891

CVE-2026-65891 — Joomla JCE Rename PoC Proof-of-concept scanner for CVE-2026-65891 in the Joomla Content Editor JCE extension. Improper input validation in the JCE file manager rename function allows an authenticated user with file-management permissions to: create hidden files dot-prefixed names...

CVE-2025-34085

CVE-2025-34085 — WordPress Simple File List Unauthenticated RCE Exploit An automated exploit and scanner for CVE-2025-34085 , a critical vulnerability in the WordPress Simple File List plugin, enabling unauthenticated remote code execution through arbitrary file upload and rename functionalities....

CVE-2026-37071

CVE-2026-37071 Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected...

CVE-2026-51705

CVE-2026-51705 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . The root cause is an incorrect access control in the setWiFiMeshName function, which allows unauthenticated attackers to rename WiFi mesh entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No sp...

CVE-2026-78699

Unchecked Return Value vulnerability in ash-project ashpostgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data...

CVE-2026-78699 rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres

Unchecked Return Value vulnerability in ash-project ashpostgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data...

CVE-2026-78699 rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres

Unchecked Return Value vulnerability in ash-project ashpostgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data...

CVE-2026-78699

ash_postgres (ash-project) versions 0.25.0 through 2.12.0 are affected by an unchecked return value in AshPostgres.MultiTenancy.rename_tenant/3. The function issues ALTER SCHEMA … RENAME TO … via the non-raising Ecto.Adapters.SQL.query/2, discards the result, and unconditionally returns :ok. When...

CVE-2026-58048-PoC-Exploit

💥 CVE‑2026‑58048 – cPanel Root SQL Execution Toolkit ⚠️ ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING This repository provides tools for authorized security professionals, blue teams, and penetration testers only. Unauthorized access to computer systems is illegal under CFAA US, Computer Misuse...

CVE-2024-44871

MoziloCMS = 3.0.1 RCE Autenticado Descrição Este script é uma ferramenta de exploração projetada para testar aplicações web que executam MoziloCMS. Ele permite que um invasor use logins de administrador para fazer upload de um web shell PHP via arquivo jpg, renomear o arquivo carregado para php e...

laravel-filemanager-unrestricted-upload

Laravel FileManager Unrestricted File Upload CVE-2025-56399 CWE-434: Uneingeschränkter Upload von Dateien mit gefährlichem Typ CVSS-Score: 8.5 Hoch 📋 Beschreibung Dieses Tool bietet einen Proof of Concept PoC für CVE-2025-56399 , eine kritische Schwachstelle in alexusmai/laravel-file-manager...

CVE-2026-82237

filebrowser through 2.63.23 does not remove share records when a shared file is renamed only deletion triggers share cleanup. The share record is keyed by path, so it survives the rename and remains dormant returning 404 while the path is empty. When any new, unrelated file later appears at the...