PT-2026-20836

Name of the Vulnerable Software and Affected Versions SoftVision webPDF versions prior to 10.0.2 Description The software contains a Server-Side Request Forgery SSRF issue. The PDF converter function does not validate requested resources in uploaded files, permitting protocols like http:// and...

PT-2026-20630

Name of the Vulnerable Software and Affected Versions Prodigy Commerce versions prior to 3.2.9 Description The Prodigy Commerce plugin for WordPress is susceptible to a Local File Inclusion issue. This allows unauthenticated attackers to include and read arbitrary files or execute arbitrary files...

SoftVision webPDF 安全漏洞

SoftVision webPDF is a PDF service platform provided by the German company SoftVision. Versions of SoftVision webPDF prior to 10.0.2 contained security vulnerabilities. These vulnerabilities stemmed from the PDF converter’s failure to check for resource requests in uploaded files, which could lea...

CVE-2025-55853

SoftVision webPDF before 10.0.2 is vulnerable to Server-Side Request Forgery SSRF. The PDF converter function does not check if internal or external resources are requested in the uploaded files and allows for protocols such as http:// and file:///. This allows an attacker to upload an XML or HTM...

WordPress plugin Airtifact 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

CVE-2026-25548

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution RCE vulnerability exists in InvoicePlane 1.7.0 through a chained Local File Inclusion LFI and Log Poisoning attack. An authenticated administrator can execute...

CVE-2026-25548 InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution RCE vulnerability exists in InvoicePlane 1.7.0 through a chained Local File Inclusion LFI and Log Poisoning attack. An authenticated administrator can execute...

CVE-2026-25548

CVE-2026-25548 affects InvoicePlane 1.7.0 (and only 1.7.0 according to the description) and enables a critical remote code execution via a chained Local File Inclusion and Log Poisoning attack. An authenticated administrator can trigger the vulnerability by manipulating the public_invoice_templat...

CVE-2026-25548 InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution RCE vulnerability exists in InvoicePlane 1.7.0 through a chained Local File Inclusion LFI and Log Poisoning attack. An authenticated administrator can execute...

CVE-2026-25548 InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution RCE vulnerability exists in InvoicePlane 1.7.0 through a chained Local File Inclusion LFI and Log Poisoning attack. An authenticated administrator can execute...

OpenClaw has a LFI in BlueBubbles media path handling

Summary The BlueBubbles extension accepted attacker-controlled local filesystem paths via mediaPath and could read arbitrary local files from disk before sending them as media attachments. Details When sendBlueBubblesMedia received a non-HTTP media source, the previous implementation resolved it ...

CVE-2025-12062

The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8.6 via the fcloadtemplate function. This makes it possible for authenticated attackers, with Subscriber-leve...

PT-2026-20546

Name of the Vulnerable Software and Affected Versions InvoicePlane versions 1.7.0 through 1.7.1 Description InvoicePlane is an open source application used for managing invoices, clients, and payments. A critical issue allows for Remote Code Execution RCE through a combination of Local File...

InvoicePlane 安全漏洞

InvoicePlane is an open-source application developed by InvoicePlane. It provides a self-hosted open-source tool for managing your quotes, invoices, customers, and payments. Version 1.7.0 of InvoicePlane contains a security vulnerability that stems from local file inclusion via links and log...

PT-2026-23564

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.14 Description The BlueBubbles extension in OpenClaw contains a local file inclusion issue in how media paths are handled. This allows attackers to read arbitrary files from the local filesystem. The...

ArcGIS Server < 11.3 Multiple Vulnerabilities (2025 Update 1)

The version of ArcGIS Server installed on the remote host is prior to 11.3. It is, therefore, affected by multiple vulnerabilities including: - A SQL injection vulnerability that allows an unauthenticated, remote attacker to inject or manipulate SQL queries in the back-end database, resulting in...

WordPress PawFriends - Pet Shop and Veterinary WordPress Theme theme <= 1.3 - Local File Inclusion vulnerability

WordPress PawFriends - Pet Shop and Veterinary WordPress Theme theme = 1.3 - Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme PawFriends - Pet Shop and Veterinary WordPress Theme versions = 1.3...

WordPress UnlimHost theme <= 1.2.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme UnlimHost versions = 1.2.3...

WordPress Netmix theme <= 1.0.10 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Netmix versions = 1.0.10...

WordPress Blabber theme <= 1.7.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Blabber versions = 1.7.0...