48689 matches found
CVE-2026-35593
Trilium Notes is an open-source, cross-platform hierarchical note taking application for building large personal knowledge bases. Versions 0.102.1 and prior are vulnerable to Local File Inclusion, allowing an authenticated attacker to read sensitive arbitrary files from the server's filesystem. T...
CVE-2026-35593 Trilium Notes has Local File Inclusion via upload modified file API endpoint
Trilium Notes is an open-source, cross-platform hierarchical note taking application for building large personal knowledge bases. Versions 0.102.1 and prior are vulnerable to Local File Inclusion, allowing an authenticated attacker to read sensitive arbitrary files from the server's filesystem. T...
CVE-2026-35593 Trilium Notes has Local File Inclusion via upload modified file API endpoint
Trilium Notes is an open-source, cross-platform hierarchical note taking application for building large personal knowledge bases. Versions 0.102.1 and prior are vulnerable to Local File Inclusion, allowing an authenticated attacker to read sensitive arbitrary files from the server's filesystem. T...
EUVD-2026-31007
Trilium Notes is an open-source, cross-platform hierarchical note taking application for building large personal knowledge bases. Versions 0.102.1 and prior are vulnerable to Local File Inclusion, allowing an authenticated attacker to read sensitive arbitrary files from the server's filesystem. T...
CVE-2026-35593
Trilium Notes (versions ≤ 0.102.1) are vulnerable to Local File Inclusion via POST /api/attachments/{attachmentId}/upload-modified-file, where the uploadModifiedFileToAttachment function replaces an attachment’s content with a file from the path provided in the request body, enabling an authentic...
CVE-2026-35593 Trilium Notes has Local File Inclusion via upload modified file API endpoint
Trilium Notes is an open-source, cross-platform hierarchical note taking application for building large personal knowledge bases. Versions 0.102.1 and prior are vulnerable to Local File Inclusion, allowing an authenticated attacker to read sensitive arbitrary files from the server's filesystem. T...
CVE-2026-29962
HSC MailInspector v5.3.3-7 contains a Local File Inclusion LFI vulnerability caused by improper control of user-supplied file paths. The endpoint /vendor/phpunit/phpunit.php processes user-controlled parameters that directly affect file access operations without adequate validation, sanitization,...
CVE-2026-29220 Apache OFBiz: Low-Privilege LFI in Content Component
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue...
CVE-2026-29220 Apache OFBiz: Low-Privilege LFI in Content Component
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue...
CVE-2026-29220 Apache OFBiz: Low-Privilege LFI in Content Component
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue...
PT-2026-42024
Trilium Notes is an open-source, cross-platform hierarchical note taking application for building large personal knowledge bases. Versions 0.102.1 and prior are vulnerable to Local File Inclusion, allowing an authenticated attacker to read sensitive arbitrary files from the server's filesystem. T...
CVE-2020-37246
Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating the download path parameter. Attackers can modify the download parameter in admin.php requests with directory traversal sequences to access...
CVE-2026-29962
HSC MailInspector v5.3.3-7 contains a Local File Inclusion LFI vulnerability caused by improper control of user-supplied file paths. The endpoint /vendor/phpunit/phpunit.php processes user-controlled parameters that directly affect file access operations without adequate validation, sanitization,...
CVE-2026-6381
The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated users to perform Local File Inclusion attacks...
CVE-2026-6381 WP Maps < 4.9.3 - Subscriber+ Local File Inclusion
The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated users to perform Local File Inclusion attacks...
CVE-2026-6381
The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated users to perform Local File Inclusion attacks...
CVE-2026-6381
The WP Maps WordPress plugin (versions prior to 4.9.3 ) is vulnerable to a Local File Inclusion (LFI) attack. The root cause is the improper sanitization of a parameter used in a file path, which allows authenticated users to perform LFI. This vulnerability is also described as a path traversal i...
EUVD-2026-30732
The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated users to perform Local File Inclusion attacks...
CVE-2026-6381 WP Maps < 4.9.3 - Subscriber+ Local File Inclusion
The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated users to perform Local File Inclusion attacks...
PT-2026-41637
Name of the Vulnerable Software and Affected Versions WP Maps versions prior to 4.9.3 Description The WP Maps WordPress plugin fails to properly sanitize a parameter used in a file path. This allows authenticated users to perform Local File Inclusion LFI, a technique where an attacker includes...