CVE-2026-84069 WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php

The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion...

EUVD-2026-87885

The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion...

Oracle WebLogic Server Local File Inclusion

An easily exploitable local file inclusion vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Successful attacks of this vulnerability can...

LimeSurvey 4.1.11 - Local File Inclusion

LimeSurvey before 4.1.12+200324 is vulnerable to local file inclusion because it contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php. id: CVE-2020-11455 info: name: LimeSurvey 4.1.11 - Local File Inclusion author: daffainfo severity: critical...

QNAP QTS Photo Station External Reference - Local File Inclusion

QNAP QTS Photo Station External Reference is vulnerable to local file inclusion via an externally controlled reference to a resource vulnerability. If exploited, this could allow an attacker to modify system files. The vulnerability is fixed in the following versions: QTS 5.0.1: Photo Station 6.1...

NAKIVO Backup and Replication Solution - Unauthenticated Arbitrary File Read

NAKIVO Backup & Replication is a data protection solution used for backing up and restoring virtualized and physical environments. A vulnerability has been identified in certain versions of NAKIVO Backup & Replication that allows an unauthenticated attacker to read arbitrary files on the underlyi...

CVE-2026-84069: Improper Limitation of a Pathname to a Restricted Directory

The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion...

CVE-2026-50547

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generatexml method appends a database-derived xmlid to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier...

CVE-2026-50547

The self-hosted open source application InvoicePlane (versions prior to 1.7.2 ) is vulnerable to Local File Inclusion (LFI) . The root cause is located in the Invoices::generate_xml() method, which appends a database-derived xml_id to the XMLconfigs helper directory and includes the resulting PHP...

CVE-2026-50547 InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generatexml method appends a database-derived xmlid to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier...

EUVD-2026-87132

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generatexml method appends a database-derived xmlid to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier...

CVE-2026-50547 InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generatexml method appends a database-derived xmlid to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-87902link is external WordPress Core Remote File Inclusion Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors an...

CVE-2026-15667

CVE-2026-15667 CVE-2026-15667 WordPress Event Solution LFI POC Eventin plugin de WordPress wp-event-solution ≤ 4.1.22 — inclusión de archivos locales autenticada Contributor+ a través del campo REST eventlayout. Solo para pruebas autorizadas. No ejecutes esto contra sistemas que no sean de tu...

CVE-2026-13456

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with...

EUVD-2026-86595

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with...

CVE-2026-13456 WP Maps <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with...

CVE-2026-13456

The WP Maps WordPress plugin (versions up to and including 4.9.8 ) is vulnerable to Local File Inclusion (LFI) via the 'page' parameter . Authenticated attackers with subscriber-level access or higher can include and execute arbitrary .php files on the server. This flaw may lead to bypassing acce...

CVE-2026-13456 WP Maps <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with...

WordPress WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings plugin <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion vulnerability

Authenticated Subscriber+ Local File Inclusion vulnerability discovered by lhking in WordPress Plugin WP Maps versions = 4.9.8...