44579 matches found
WordPress Portfolio Builder plugin <= 1.2.5 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Portfolio Builder versions = 1.2.5...
WordPress Eleblog – Elementor Blog And Magazine Addons plugin <= 2.0.3 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Eleblog – Elementor Blog And Magazine Addons versions = 2.0.3...
WordPress Golo theme < 1.7.5 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Golo versions 1.7.5...
survey-pdf Upgraded jsPDF Version Due to Security Vulnerability
The following security vulnerability was identified in jsPDF versions = 4.0.0 and included the fix in the following survey-pdf releases: v1.12.59 v2.5.5 Action Users should upgrade survey-pdf in their projects to v1.12.59+ or v2.5.5+ immediately. Notes No other survey-pdf dependencies are affecte...
GHSA-H3Q6-JFRG-3X6Q survey-pdf Upgraded jsPDF Version Due to Security Vulnerability
The following security vulnerability was identified in jsPDF versions = 4.0.0 and included the fix in the following survey-pdf releases: v1.12.59 v2.5.5 Action Users should upgrade survey-pdf in their projects to v1.12.59+ or v2.5.5+ immediately. Notes No other survey-pdf dependencies are affecte...
CVE-2026-25475 OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction
OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/fil...
CVE-2026-25475
OpenClaw OpenAI-like assistant is vulnerable to local file inclusion via MEDIA: paths through isValidMedia() in src/media/parse.ts. Prior to version 2026.1.30, the function accepts absolute paths, home directory references, and directory-traversal sequences, allowing an agent to read arbitrary fi...
CVE-2026-25475 OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction
OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/fil...
CVE-2026-25475 OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction
OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/fil...
CVE-2026-25027
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeMove Unicamp unicamp allows PHP Local File Inclusion.This issue affects Unicamp: from n/a through = 2.7.1...
GHSA-R8G4-86FX-92MQ OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction
Summary The isValidMedia function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/file, exfiltrating sensitive data to the user/channel. Detai...
CVE-2025-15368
The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26 via shortcodes 'templatename' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files...
CVE-2025-15368
Vulnerability summary (CVE-2025-15368) : The SportsPress WordPress plugin (versions up to 2.7.26) is vulnerable to Local File Inclusion via the shortcodes’ template_name attribute. Authenticated attackers with contributor-level permissions or higher can include and execute arbitrary server files,...
EUVD-2025-206819
The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26 via shortcodes 'templatename' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files...
CVE-2025-15368 SportsPress <= 2.7.26 - Authenticated (Contributor+) Local File Inclusion via Shortcode
The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26 via shortcodes 'templatename' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files...
CVE-2025-15368 SportsPress <= 2.7.26 - Authenticated (Contributor+) Local File Inclusion via Shortcode
The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26 via shortcodes 'templatename' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files...
WordPress TopperPack – Complete Elementor Addons, theme & CPT Builder plugin <= 1.2.1 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Skalucy in WordPress Plugin TopperPack – Complete Elementor Addons, Theme & CPT Builder versions = 1.2.1...
WordPress VidoRev theme <= 2.9.9.9.9.9.7 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme VidoRev versions = 2.9.9.9.9.9.7...