auto_re

AutoRE Features 1. Auto-renaming dummy-named functions, which have one API call or jump to the imported API Before After 2. Assigning TAGS to functions accordingly to called API-indicators inside Sets tags as repeatable function comments and displays TAG tree in the separate view Some screenshots...

CVE-2025-34085-Multi-target

CVE-2025-34085 Multi-Target RCE Scanner Mass-exploitation scanner for CVE-2025-34085 — an unauthenticated remote code execution vulnerability in the WordPress Simple File List plugin. This tool uploads a PHP payload disguised as an image, renames it via a vulnerable file engine, and triggers shel...

CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV

Executive summary macOS Music and TV do an insecure rename resulting in FDA by gaining full control over the user's TCC.db I reported this bug in separate tickets for each app, feel free to merge if applicable. The underlying problem is that these apps have FDA but fail to sanitize their file...

auto_re

AutoRE Возможности 1. Автоматическое переименование функций с фиктивными именами, которые содержат один вызов API или переход к импортированному API До После 2. Присвоение ТЕГОВ функциям на основе вызываемых API-индикаторов внутри Устанавливает теги в виде повторяемых комментариев к функциям и...

CVE-2026-58048-PoC-Exploit

💥 CVE‑2026‑58048 – Инструментарий для выполнения SQL-запросов с правами root в cPanel ⚠️ ТОЛЬКО ЭТИЧНОЕ ИСПОЛЬЗОВАНИЕ – АВТОРИЗОВАННОЕ ТЕСТИРОВАНИЕ БЕЗОПАСНОСТИ Этот репозиторий предоставляет инструменты исключительно для авторизованных специалистов по безопасности, blue teams и пентестеров...

delete-self-poc

🗑️ delete-self-poc delete-self-poc — это демонстрация метода удаления заблокированного исполняемого файла или файла, который в данный момент выполняется, с диска. Эта концепция была первоначально обнаружена Йонасом Люккегором, и я создал для неё доказательство концепции POC. Кроме того, его можно...

Frontend File Manager < 21.3 - Unauthenticated File Renaming

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server id:...

CVE-2025-34085

CVE-2025-34085 — WordPress Simple File List Unauthenticated RCE Exploit An automated exploit and scanner for CVE-2025-34085 , a critical vulnerability in the WordPress Simple File List plugin, enabling unauthenticated remote code execution through arbitrary file upload and rename functionalities....

laravel-filemanager-unrestricted-upload

Laravel FileManager Unrestricted File Upload CVE-2025-56399 CWE-434: Unrestricted Upload of File with Dangerous Type CVSS Score: 8.5 High 📋 Description This tool provides a Proof of Concept PoC for CVE-2025-56399 , a critical vulnerability in alexusmai/laravel-file-manager versions ≤ 3.3.1. The...

CVE-2025-56399

CVE-2025-56399 – Authenticated Remote Code Execution in laravel-file-manager v3.3.1 🧭 Overview An authenticated Remote Code Execution RCE vulnerability in laravel-file-manager v3.3.1 and below allows attackers with access to the file manager interface to execute arbitrary code on the server. By...

POC-CVE-2026-58048

CVE-2026-58048 CVSS 4.0: 9.4 Critical | CWE-89: SQL Injection | NVD Аутентифицированный пользователь cPanel → произвольный SQL от имени MySQL root через переименование базы данных. cPanel некорректно сохраняет sqlmode сессии пользователя ANSIQUOTES при выполнении операций переименования от имени...

CVE-2026-37071

CVE-2026-37071 Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected...

CVE-2024-44871

MoziloCMS = 3.0.1 Authenticated RCE Description This script is an exploit tool designed for testing web applications running MoziloCMS. It allows an attacker to use admin logins to upload a PHP web shell via jpg file, rename the uploaded file to php, and send system commands to the target through...

CVE-2026-65891

CVE-2026-65891 — PoC переименования Joomla JCE Сканер доказательства концепции для CVE-2026-65891 в расширении Joomla Content Editor JCE. Некорректная проверка входных данных в функции переименования файлового менеджера JCE позволяет аутентифицированному пользователю с правами управления файлами:...

CVE-2024-21546

UniSharp Laravel Filemanager 인증 없이 RCE CVE-2024-21546 이 저장소는 UniSharp/laravel-filemanager 패키지버전 file-getClientOriginalExtension; if inarray$extension, $unallowedextensions throw new \Exception'File extension is not allowed.'; return $this; 공격자가 poc.php.라는 파일을 업로드하면: Symfony의...

CVE-2026-92986

SiYuan before 3.8.4 is affected by a Cross-Site Scripting (XSS) vulnerability in the backlink dock tree , where document titles are rendered as HTML without escaping markup characters. An attacker can set a malicious title via the rename API or crafted notebooks, executing scripts in the Electron...

CVE-2025-23968

AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o The AI Bud plugin exposes a REST API endpoint /wp-json/ai-buddy/v1/wp/attachments that allows uploading files to the WordPress media library. The endpoint’s file logic contains file renaming functionality that triggers after file...

CVE-2026-92247

SynaptikCMS 파일 관리자 — 인증된 RCE 취약점 SynaptikCMS 파일 관리자 인증된 원격 코드 실행 SynaptikCMS의 파일 관리자는 인증된 공격자가 파일을 업로드한 후 이를 PHP 파일로 이름을 변경할 수 있도록 허용합니다. 이러한 업로드 및 이름 변경 동작은 실행 가능한 PHP 코드를 웹에서 접근 가능한 위치에 배치하는 데 악용될 수 있으며, 그 결과 웹 서버의 컨텍스트에서 원격 코드 실행이 발생합니다. 연구자: D1n3sh 영향받는 구성 요소 root@kitploit:...

CVE-2025-34085

📂 Simple File List – Unauthenticated RCE Exploit CVE-2025-34085 ⚠️ Exploit Code by: Mrj Haxcore A fully working Python exploit for the WordPress Simple File List plugin = 4.2.3, which is vulnerable to unauthenticated remote code execution RCE due to insecure file upload and rename logic. 💣...

CVE-2025-34085

Cyberlone Indonesia 🛠️ Сканер RCE для WordPress Simple File List + Автоочистка Автоматический инструмент для обнаружения и эксплуатации удаленного выполнения кода RCE без аутентификации в плагине WordPress Simple File List , особенно уязвимых к CVE-2025-34085. Оснащен системой автоматической...