PT-2024-37129 · Zen Cart · Zen Cart

Name of the Vulnerable Software and Affected Versions: Zen Cart affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Zen Cart. The specific flaw exists within the findPluginAdminPage function, resulting from the lac...

PT-2024-3331 · D Link · D-Link Dir-845L

Name of the Vulnerable Software and Affected Versions: D-LINK DIR-845L versions =v1.01KRb03 Description: The issue is related to insufficient protection of internal data when handling the file parameter, potentially allowing a remote attacker to gain unauthorized access to protected information...

Trend Micro Apex Central widget WFProxy Local File Inclusion Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex Central. Authentication is required to exploit this vulnerability. The specific flaw exists within the getObjWGFServiceApiByApiName function. The issue results from the lack of prope...

PT-2023-32349

Name of the Vulnerable Software and Affected Versions The News & Blog Designer Pack – WordPress Blog Plugin versions up to, and including, 3.4.1 Description The issue is related to Remote Code Execution via Local File Inclusion. This is due to the bdp get more post function utilizing an unsafe...

Cacti link Local File Inclusion Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cacti. Authentication is required to exploit this vulnerability. The specific flaw exists within the link endpoint. The issue results from the lack of proper validation of data retrieved from the...

Advantech R-SeeNet device_status Local File Inclusion Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of Advantech R-SeeNet. Authentication is required to exploit this vulnerability. The specific flaw exists within the devicestatus page. The issue results from the lack of proper validation of user-supplied...

Code injection

The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks...

CVE-2023-1274

The Pricing Tables For WPBakery Page Builder formerly Visual Composer WordPress plugin before 3.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks...

Luocms Cross-Site Scripting Vulnerability

Luocms is an article management system. A cross-site scripting vulnerability exists in Luocms v2.0, which stems from a lack of data validation filtering of user-supplied data and output in /admin/news/sortadd.php and /inc/function.php. An attacker could use this vulnerability to execute JavaScrip...

CVE-2021-24644: Improper Limitation of a Pathname to a Restricted Directory

The Images to WebP WordPress plugin before 1.9 does not validate or sanitise the tab parameter before passing it to the include function, which could lead to a Local File Inclusion issue...

CVE-2020-20907

MetInfo 7.0 beta is affected by a file modification vulnerability. Attackers can delete and modify ini files in app/system/language/admin/languagegeneral.class.php and app/system/include/function/file.func.php...

CVE-2020-20907: Improper Limitation of a Pathname to a Restricted Directory

MetInfo 7.0 beta is affected by a file modification vulnerability. Attackers can delete and modify ini files in app/system/language/admin/languagegeneral.class.php and app/system/include/function/file.func.php...

ColdFusion PHP Function Execution

The vulnerability of the ColdFusion software platform relates to the names of PHP functions include or require. Exploiting this vulnerability allows a malicious actor to execute arbitrary PHP code on the target system by sending a specially crafted HTTP request...

CVE-2005-3056

TWiki is affected by CVE-2005-3056 due to an arbitrary shell command execution flaw in the Include function. The vulnerability enables an attacker to execute commands on the server when TWiki processes Include, with network access, no authentication, and no user interaction required in the CVSS a...

PT-2019-6478

Name of the Vulnerable Software and Affected Versions TWiki versions affected versions not specified Description The issue allows for arbitrary shell command execution via the Include function. This could potentially lead to unauthorized access and control of the system. Recommendations At the...

CVE-2005-3056: Improper Neutralization of Special Elements in Output Used by a Downstream Component

TWiki allows arbitrary shell command execution via the Include function...

CVE-2019-10666: Inclusion of Functionality from Untrusted Control Sphere

An issue was discovered in LibreNMS through 1.47. Several of the scripts perform dynamic script inclusion via the include function on user supplied input without sanitizing the values by calling basename or a similar function. An attacker can leverage this to execute PHP code from the included...

PT-2019-11979

Name of the Vulnerable Software and Affected Versions LibreNMS versions through 1.47 Description An issue was discovered in LibreNMS where several scripts perform dynamic script inclusion via the include function on user-supplied input without sanitizing the values. This allows an attacker to...

Local PHP File Inclusion in ResourceSpace

High-Tech Bridge Security Research Lab discovered vulnerability in ResourceSpace, which can be exploited to include arbitrary local PHP file, execute PHP code, and compromise vulnerable web application and even entire web server on which the application is hosted. The vulnerability exists due to...

WD Arkeia Virtual Appliance Directory Traversal / Command Execution

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Path Traversal/Remote Code Execution product: WD Arkeia Virtual Appliance AVA vulnerable version: All Arkeia Network Backup releases ASA/APA/AVA since 7.0.3. fixed versio...