48516 matches found
CVE-2026-28151: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Tonda 2.6 versions...
PT-2026-80839
Unauthenticated Local File Inclusion in WP Cafe Pro 3.0.15 versions...
PT-2026-80844
Unauthenticated Local File Inclusion in Verdure Core = 1.2 versions...
PT-2026-80824
Unauthenticated Local File Inclusion in Tonda Core 2.6 versions...
PT-2026-80823
Unauthenticated Local File Inclusion in Tonda 2.6 versions...
PT-2026-81050
Name of the Vulnerable Software and Affected Versions MagicAI for WordPress versions 1.4 and earlier Description A Local File Inclusion issue exists that allows users with Subscriber privileges to read arbitrary files on the server. Recommendations Update MagicAI for WordPress to a version later...
PT-2026-80843
Unauthenticated Local File Inclusion in Måne = 1.7 versions...
WordPress Events Made Easy plugin <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property vulnerability
Authenticated Contributor+ Local File Inclusion via 'wppagetemplate' Event Property vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Events Made Easy versions = 3.2.5...
GHSA-2223-F22X-24CQ Winter: Local File Inclusion through =include directives in JavaScript asset compilation
Impact Affected versions of Winter CMS allow authenticated backend users with the cms.manageassets permission "Manage website assets - images, JavaScript files, CSS files" to disclose arbitrary files readable by the PHP process by placing an =include / =require directive in a theme JavaScript...
Winter: Local File Inclusion through =include directives in JavaScript asset compilation
Impact Affected versions of Winter CMS allow authenticated backend users with the cms.manageassets permission "Manage website assets - images, JavaScript files, CSS files" to disclose arbitrary files readable by the PHP process by placing an =include / =require directive in a theme JavaScript...
GHSA-58FP-MCX6-7QF9 Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets
Impact Affected versions of Winter CMS allow authenticated backend users with the following permissions to disclose arbitrary files readable by the PHP process by injecting @import inline "" directives into LESS source that the backend compiles. Four entry points share the same root cause: - Bran...
Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets
Impact Affected versions of Winter CMS allow authenticated backend users with the following permissions to disclose arbitrary files readable by the PHP process by injecting @import inline "" directives into LESS source that the backend compiles. Four entry points share the same root cause: - Bran...
NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution
Executive Summary Two vulnerabilities were identified and chained to achieve authenticated remote code execution The first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk including the application directory itself by supplying an...
GHSA-GHVF-QF6H-G8X5 NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution
Executive Summary Two vulnerabilities were identified and chained to achieve authenticated remote code execution The first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk including the application directory itself by supplying an...
CVE-2026-28150
Unauthenticated Local File Inclusion in Golo Framework 1.7.5 versions...
CVE-2026-66586
Author Local File Inclusion in WP Cafe Pro 3.0.15 versions...
CVE-2025-15637
Unauthenticated Local File Inclusion in Shuffle = 1.8 versions...
CVE-2026-66586
WordPress WP Cafe Pro plugin (versions below 3.0.15) has a Local File Inclusion vulnerability, discovered by Ananda Dhakal of Patchstack. An authenticated author with high privileges can exploit it over the network to read sensitive server files, potentially compromising confidentiality, integrit...
