CVE-2024-57152

Incorrect access control in the preHandle function of my-site v1.0.2 allows attackers to access sensitive components without authentication via the cn.luischen.interceptor.BaseInterceptor class...

CVE-2025-28041

Incorrect access control in the doFilter function of itranswarp up to 2.19 allows attackers to access sensitive components without authentication...

CVE-2025-54017

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows PHP Local File Inclusion.This issue affects Paid Member Subscriptions: from n/a through = 2.15.4...

CVE-2025-53198

Houzez WordPress theme

CVE-2025-53207

CVE-2025-53207 is a confirmed Local File Inclusion vulnerability in the WordPress plugin WP Travel Gutenberg Blocks (affected: versions up to 3.9.0). The root cause is improper control of the filename used in PHP include/require statements, enabling LFI and potentially local file exposure. CVSS v...

PT-2025-33919 · Caliris +1 · Caliris +1

Name of the Vulnerable Software and Affected Versions: Caliris versions not specified through 1.5 Description: This issue involves an improper control of filename for include/require statements in PHP programs, specifically a PHP Local File Inclusion in CocoBasic Caliris. Recommendations: At the...

iTranswarp 安全漏洞

iTranswarp is a full-featured CMS by Crypto Michael Individual Developers. A security vulnerability exists in iTranswarp 2.19 and earlier versions that stems from improper access control of the doFilter function, which could lead to unauthenticated access to sensitive components...

CVE-2024-57157

Incorrect access control in Jantent v1.1 allows attackers to bypass authentication and access sensitive APIs without a token...

CVE-2024-57154

Incorrect access control in dts-shop v0.0.1-SNAPSHOT allows attackers to bypass authentication via sending a crafted payload to /admin/auth/index...

CVE-2025-28041

The CVE-2025-28041 entry concerns iTranswarp (CMS) versions up to 2.19 with a root cause of incorrect access control in the doFilter function. This allows unauthenticated actors to access sensitive components. Public reports from multiple sources (including Red Hat and CNNVD) confirm the same des...

CVE-2024-53495

CVE-2024-53495 affects my-site v1.0.2.RELEASE. The root cause is incorrect access control in the preHandle function, permitting access to sensitive components without authentication. The vulnerability is rated CVSS v3.1 base score 7.5 (HIGH) with network attack vector, low exploit complexity, and...

PT-2025-34007 · Unknown · Schiocco Support Board

Name of the Vulnerable Software and Affected Versions: Schiocco Support Board versions through 3.8.0 Description: The software contains an improper control of filename for include/require statements, leading to a PHP local file inclusion issue. Recommendations: Versions prior to 3.8.0 are affecte...

CVE-2025-28041

Incorrect access control in the doFilter function of itranswarp up to 2.19 allows attackers to access sensitive components without authentication...

CVE-2025-51529

Incorrect Access Control in the AJAX endpoint functionality in jonkastonka Cookies and Content Security Policy plugin through version 2.29 allows remote attackers to cause a denial of service database server resource exhaustion via unlimited database write operations to the...

CVE-2025-51529

CVE-2025-51529 affects the WordPress plugin “jonkastonka Cookies and Content Security Policy” up to version 2.29. The vulnerability is an incorrect access control in the AJAX endpoint function cacsp_insert_consent_data, exposed via wp-admin/admin-ajax.php with wp_ajax_nopriv_ and no authenticatio...

CVE-2025-52728

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows PHP Local File Inclusion.This issue affects Responsive Posts Carousel Pro: from n/a through = 15...

HCL Connections 安全漏洞

HCL Connections is a suite of enterprise collaboration platforms from HCL India. A security vulnerability exists in HCL Connections that stems from an access control flaw that could lead to unauthorized users updating data...

CVE-2025-22839

Insufficient granularity of access control in the OOB-MSM for some IntelR XeonR 6 Scalable processors may allow a privileged user to potentially enable escalation of privilege via adjacent access...

CVE-2025-25172

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in beeteam368 VidMov vidmov allows PHP Local File Inclusion.This issue affects VidMov: from n/a through = 1.9.4...

CVE-2025-54691 WordPress Motors Plugin plugin <= 1.4.80 - Insecure Direct Object References (IDOR) Vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Stylemix Motors allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Motors: from n/a through 1.4.80...