PT-2025-43163

Name of the Vulnerable Software and Affected Versions WP Abstracts versions through 2.7.4 Description The software contains a flaw related to improper control of filename for include/require statements, specifically a PHP Local File Inclusion issue. This allows for the inclusion of local files...

WordPress plugin Businext 安全漏洞

WordPress Businext plugin is a WordPress theme designed for business and financial institutions, offering highly specialized features and layout options for scenarios such as official corporate websites, law firms, investment institutions, and more. WordPress Businext plugin suffers from a file...

WordPress plugin Testimonial Slider And Showcase Pro 安全漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plug-in. A security vulnerability exists in the WordPress plugi...

PT-2025-43185

Name of the Vulnerable Software and Affected Versions CrocoBlock JetReviews versions through 3.0.0 Description A flaw exists in CrocoBlock JetReviews that allows for PHP Local File Inclusion due to improper control of filename for include/require statements. This issue is related to a PHP Remote...

WordPress plugin Grevo 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

Security Bulletin: Local File Inclusion (LFI) vulnerability in IBM Content Navigator

Summary A Local File Inclusion LFI vulnerability has been identified in IBM Content Navigator ICN, where an authenticated attacker can exploit an HTTPS request URL in a way that it will return content of any file from the server where ICN is running. Vulnerability Details CVEID:CVE-2025-27906...

CVE-2025-60344

A path traversal directory traversal vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used for file or directory path resolution e.g., via sequences such as “../”. Successful exploitation may allow access to files outside of the...

EUVD-2025-35178

An unauthenticated Local File Inclusion LFI vulnerability in D-Link DSR series routers allows remote attackers to retrieve sensitive configuration files in clear text. The exposed files contain administrative credentials, VPN settings, and other sensitive information, enabling full administrative...

WordPress BlindMatrix e-Commerce plugin file inclusion vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A file inclusion vulnerability exists in the WordPress BlindMatrix e-Commerce plugin that stems from an unvalidated shortcode attribute that can be exploited by an attacker to...

D-Link DSR-150 安全漏洞

D-Link DSR-150 is a Unified Services Router from China AUO D-Link. A security vulnerability exists in the D-Link DSR-150 v1.09B32WWW, which stems from an unauthenticated local file inclusion vulnerability that could allow a remote attacker to gain access to sensitive configuration files in...

CVE-2025-60344

A path traversal directory traversal vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used for file or directory path resolution e.g., via sequences such as “../”. Successful exploitation may allow access to files outside of the...

CVE-2025-60344

A path traversal directory traversal vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used for file or directory path resolution e.g., via sequences such as “../”. Successful exploitation may allow access to files outside of the...

CVE-2025-60344

CVE-2025-60344 describes a path traversal vulnerability in the D-Link DSR series (DSR-150, DSR-150N, DSR-250N v1.09B32_WW). Unauthenticated remote attackers can manipulate file/directory path resolution (e.g., via “../”) due to insufficient input validation, potentially exposing sensitive system ...

WordPress Stockholm Core plugin <= 2.4.6 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Stockholm Core versions = 2.4.6...

WordPress Stockholm theme <= 9.14.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Stockholm versions = 9.14.1...

WordPress Savory theme <= 2.5 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by ? in WordPress Theme Savory versions = 2.5...

WordPress Revolution theme < 2.5.8 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by ? in WordPress Theme Revolution versions 2.5.8...

WordPress Eduma theme <= 5.7.6 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Eduma versions = 5.7.6...

CVE-2025-58051 Nextcloud Tables app allowed to include local file via PhpSpreadsheet when importing a table

Nextcloud Tables allows you to create your own tables with individual columns. Prior 0.7.6, 0.8.8, and 0.9.5, when importing a table, a user was able to specify files on the server and when their format is supported by the used PhpSpreadsheet library they would be included and their content leake...

CVE-2025-58051 Nextcloud Tables app allowed to include local file via PhpSpreadsheet when importing a table

Nextcloud Tables allows you to create your own tables with individual columns. Prior 0.7.6, 0.8.8, and 0.9.5, when importing a table, a user was able to specify files on the server and when their format is supported by the used PhpSpreadsheet library they would be included and their content leake...