CVE-2025-2294

CVE-2025-2294 🚨 CVE-2025-2294 - Local File Inclusion LFI Vulnerability in Kubio AI Page Builder for WordPress 🧱 🔍 Overview CVE-2025-2294 is a critical 🔥 Local File Inclusion LFI vulnerability affecting the Kubio AI Page Builder plugin for WordPress versions up to and including 2.5.1. This flaw...

liffy

Advanced LFI Exploitation Tool A powerful Python tool for Local File Inclusion LFI exploitation with advanced features including WAF bypass, encoding techniques, and comprehensive vulnerability detection. Liffy v2.0 is the significantly enhanced version of liffy which was originally created by...

By-Poloss..-..CVE-2026-7515-PoC

CVE-2026-7515: BetterDocs Pro views-get"layouts/encyclopedia/$docstyle", 'doc' = $doc, 'excerpt' = $excerpt, 'dictionarylearnmoretext' = $learnmoretext, 'itemheadingtag' = $itemheadingtag,...

CVE-2025-68645

🛡️ CVE-2025-68645 - Zimbra Local File Inclusion LFI Analysis 📌 Overview This document describes a Local File Inclusion LFI vulnerability affecting Zimbra Collaboration Suite. The issue arises from improper handling of the following parameter: /h/?javax.servlet.include.servletpath= This allows an...

CVE-2024-4956

CVE-2024-4956 Quick and easy exploitation of CVE-2024-4956 for LFI based on original PoC from: VeryLazyTech, https://github.com/verylazytech/CVE-2024-4956. This implementation takes 2 arguments, url and file, and presents the output of the file if it is found...

CVE-2022-47615

CVE-2022-47615 LearnPress Plugin 4.2.0 - Unauthenticated LFI Description Description The plugin does not validate various parameters in the lp/v1/courses/archive-course REST endpoints before using them in include statement, which could lead to LFI issues. How to use $ python3 exploit.py -u...

LFiFreak

LFI Freak Features Works with Windows, Linux and OS X Includes bind and reverse shell for both Windows and Linux Written in Python 2.7 What is this all about? A unique tool for exploiting local file inclusions using PHP Input, PHP Filter and Data URI methods. Dependencies BeautifulSoup Disclaimer...

Vailyn

Vailyn Phased Path Traversal & LFI Attacks Vailyn 3.0 Since v3.0, Vailyn supports LFI PHP wrappers in Phase 1. Use --lfi to include them in the scan. About Vailyn is a multi-phased vulnerability analysis and exploitation tool for path traversal and file inclusion vulnerabilities. It is built to...

LFI-FINDER

🍀 LFI FINDER TOOL 🍀 Written by TMRSWRR Version 1.0.0 Instagram: TMRSWRR 📹 How to use 📹 Click on the image... LFI-FINDER is an open-source tool available on GitHub that focuses on detecting Local File Inclusion LFI vulnerabilities. Local File Inclusion is a common security vulnerability that allow...

By-Poloss..-..CVE-2026-39938

CVE-2026-39938: Cacti = 1.2.30 - Unauthenticated LFI Executive Summary Field| Value ---|--- CVE ID| CVE-2026-39938 CVSS Score| 9.8 Critical Affected Product| Cacti Affected Versions| = 1.2.30 Patched Version| 1.2.31 Fix Commit| 9871f0c Vulnerability Details Root Cause The vulnerability exists in...

LFISuite

LFI Suite What is LFI Suite? LFI Suite is a totally automatic tool able to scan and exploit Local File Inclusion vulnerabilities using many different methods of attack, listed in the section Features. Features Works with Windows, Linux and OS X Automatic Configuration Automatic Update Provides 8...

Vuln_Remediation_MegaQuagga

VulnRemediationMegaQuagga Remediation report for MegaQuagga Publishing validating the mitigation of CVE-2019-9978 through progressive defensive layering. Documents reverse proxy insertion, ModSecurity WAF deployment, Graylog SIEM integration, and SSL/TLS enforcement using multi-stage Wireshark PC...

CVE-2026-120841

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8...

CVE-2026-120839

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8...

CVE-2026-120839

The Magepeople inc. WpTravelly tour-booking-manager WordPress plugin is vulnerable to Local File Inclusion (LFI) in versions 2.3.8 and below . This flaw stems from Improper Control of Filename for Include/Require Statement in PHP Program (CWE-98), allowing an attacker to include local files on th...

CVE-2026-120839 WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8...

EUVD-2026-119250

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8...

WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Khanh Nguyen in WordPress Plugin WpTravelly versions = 2.3.8...

CVE-2026-120841

The Magepeople inc. WpTravelly (tour-booking-manager) WordPress plugin is vulnerable to a Local File Inclusion (LFI) flaw in versions up to and including 2.3.8 . The root cause is identified as an Improper Control of Filename for Include/Require Statement in PHP Program (CWE-98). This allows an a...

EUVD-2026-119249

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8...