Stored script execution via predictable upload filenames

Weak filename generation in Formidable 2.x before 2.1.3 and 3.x before 3.5.3 allows remote authenticated users to trigger stored scripts. The default _getNewName path uses hexoid, whose Math.random-based prefix is reused while only a two-character counter changes, to name files before validation finishes. Exploitation requires an application that exposes uploads, retains extensions or serves the upload directory, and reveals enough of a filename to guess another; ordinary uses are not inherently exploitable.