PT-2025-43185

Name of the Vulnerable Software and Affected Versions CrocoBlock JetReviews versions through 3.0.0 Description A flaw exists in CrocoBlock JetReviews that allows for PHP Local File Inclusion due to improper control of filename for include/require statements. This issue is related to a PHP Remote...

PT-2025-43163

Name of the Vulnerable Software and Affected Versions WP Abstracts versions through 2.7.4 Description The software contains a flaw related to improper control of filename for include/require statements, specifically a PHP Local File Inclusion issue. This allows for the inclusion of local files...

WordPress plugin Grevo 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

Security Bulletin: Local File Inclusion (LFI) vulnerability in IBM Content Navigator

Summary A Local File Inclusion LFI vulnerability has been identified in IBM Content Navigator ICN, where an authenticated attacker can exploit an HTTPS request URL in a way that it will return content of any file from the server where ICN is running. Vulnerability Details CVEID:CVE-2025-27906...

CVE-2025-60344

A path traversal directory traversal vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used for file or directory path resolution e.g., via sequences such as “../”. Successful exploitation may allow access to files outside of the...

D-Link DSR-150 安全漏洞

D-Link DSR-150 is a Unified Services Router from China AUO D-Link. A security vulnerability exists in the D-Link DSR-150 v1.09B32WWW, which stems from an unauthenticated local file inclusion vulnerability that could allow a remote attacker to gain access to sensitive configuration files in...

WordPress BlindMatrix e-Commerce plugin file inclusion vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A file inclusion vulnerability exists in the WordPress BlindMatrix e-Commerce plugin that stems from an unvalidated shortcode attribute that can be exploited by an attacker to...

EUVD-2025-35178

An unauthenticated Local File Inclusion LFI vulnerability in D-Link DSR series routers allows remote attackers to retrieve sensitive configuration files in clear text. The exposed files contain administrative credentials, VPN settings, and other sensitive information, enabling full administrative...

CVE-2025-60344

A path traversal directory traversal vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used for file or directory path resolution e.g., via sequences such as “../”. Successful exploitation may allow access to files outside of the...

CVE-2025-60344

CVE-2025-60344 describes a path traversal vulnerability in the D-Link DSR series (DSR-150, DSR-150N, DSR-250N v1.09B32_WW). Unauthenticated remote attackers can manipulate file/directory path resolution (e.g., via “../”) due to insufficient input validation, potentially exposing sensitive system ...

CVE-2025-60344

A path traversal directory traversal vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used for file or directory path resolution e.g., via sequences such as “../”. Successful exploitation may allow access to files outside of the...

WordPress Stockholm Core plugin <= 2.4.6 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Stockholm Core versions = 2.4.6...

WordPress Stockholm theme <= 9.14.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Stockholm versions = 9.14.1...

WordPress Savory theme <= 2.5 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by ? in WordPress Theme Savory versions = 2.5...

WordPress Revolution theme < 2.5.8 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by ? in WordPress Theme Revolution versions 2.5.8...

WordPress Eduma theme <= 5.7.6 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Eduma versions = 5.7.6...

CVE-2025-58051 Nextcloud Tables app allowed to include local file via PhpSpreadsheet when importing a table

Nextcloud Tables allows you to create your own tables with individual columns. Prior 0.7.6, 0.8.8, and 0.9.5, when importing a table, a user was able to specify files on the server and when their format is supported by the used PhpSpreadsheet library they would be included and their content leake...

CVE-2025-58051

CVE-2025-58051 affects Nextcloud Tables. Prior to versions 0.7.6, 0.8.8, and 0.9.5, the app allowed a user importing a table to specify server files; if the file format is supported by PhpSpreadsheet, the file content could be leaked to the user via path traversal. This is a server-side disclosur...

CVE-2025-58051 Nextcloud Tables app allowed to include local file via PhpSpreadsheet when importing a table

Nextcloud Tables allows you to create your own tables with individual columns. Prior 0.7.6, 0.8.8, and 0.9.5, when importing a table, a user was able to specify files on the server and when their format is supported by the used PhpSpreadsheet library they would be included and their content leake...

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 6, 2025 to October 12, 2025)

Calling all Vulnerability Researchers and Bug Bounty Hunters! Operation: Maximum Impact Challenge ! Now through November 10, 2025, earn 2X bounty rewards forall in-scope submissions in software with at least 5,000 active installs and fewer than 5 million active installs. Bounties up to $31,200 pe...