CVE-2023-49544

CVE-2023-49544 describes a Local File Inclusion (LFI) in Customer Support System v1, exploitable via the page= parameter in /customer_support/index.php to include internal PHP files and gain unauthorized access. Documented impact: confidentiality of internal files is H, with no indicated impact o...

CVE-2023-49544

A local file inclusion LFI in Customer Support System v1 allows attackers to include internal PHP files and gain unauthorized acces via manipulation of the page= parameter at /customersupport/index.php...

[SECURITY] [DLA 3744-1] python-django security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3744-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb February 29, 2024 https://wiki.debian.org/LTS -...

WP Rocket < 2.10.3 - Local File Inclusion (LFI)

Paulos Yibelo discovered and reported this Local File Inclusion vulnerability in WordPress WP Rocket Plugin. This could allow a malicious actor to include local files of the target website and show its output onto the screen. Files which store credentials, such as database credentials, could...

CVE-2024-1644

Suite CRM version 7.14.2 allows including local php files. This is possible because the application is vulnerable to LFI...

Code injection

Suite CRM version 7.14.2 allows including local php files. This is possible because the application is vulnerable to LFI...

CVE-2024-1644

CVE-2024-1644 affects SuiteCRM v7.14.2, where a Local File Inclusion (LFI) vulnerability allows including local PHP files. Multiple connected sources describe the issue as a code vulnerability enabling LFI, with some references explicitly noting possible Remote Code Execution (RCE) via LFI. The r...

Local File Inclusion (LFI)

zmarkdown is vulnerable to Local File Inclusion LFI. The vulnerability is due to improper restrictions of images paths within LaTeX documents. This allowed an attacker to specify a local file path e.g., /tmp/img.png in the image markdown syntax which leads to Local File Inclusion LFI, resulting i...

Cacti pollers.php SQL Injection / Remote Code Execution Exploit

This Metasploit exploit module leverages sql injection and local file inclusion vulnerabilities in Cacti versions prior to 1.2.26 to achieve remote code execution. Authentication is needed and the account must have access to the vulnerable PHP script pollers.php. This is granted by setting the...

Cacti pollers.php SQL Injection / Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cacti RCE via SQLi in pollers.php', 'Description' = %q This exploit module leverages a SQLi CVE-2023-49085 and a LFI CVE-2023-49084 vulnerability...

CVE-2021-24566

The WooCommerce Currency Switcher FOX WordPress plugin before 1.3.7 was vulnerable to LFI attacks via the "woocs" shortcode...

Code injection

The WooCommerce Currency Switcher FOX WordPress plugin before 1.3.7 was vulnerable to LFI attacks via the "woocs" shortcode...

CVE-2021-24566

CVE-2021-24566 affects the WooCommerce Currency Switcher FOX WordPress plugin prior to 1.3.7. The vulnerability is a Local File Inclusion (LFI) via the woocs shortcode that can be exploited to access files on the server. Some sources characterize exploitation as Authenticated (Low Privilege) LFI ...

CVE-2021-24566 WooCommerce Currency Switcher < 1.3.7 - Authenticated (Low Privilege) Local File Inclusion

The WooCommerce Currency Switcher FOX WordPress plugin before 1.3.7 was vulnerable to LFI attacks via the "woocs" shortcode...

CVE-2021-24566 WooCommerce Currency Switcher < 1.3.7 - Authenticated (Low Privilege) Local File Inclusion

The WooCommerce Currency Switcher FOX WordPress plugin before 1.3.7 was vulnerable to LFI attacks via the "woocs" shortcode...

CVE-2023-49715

A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution when chained with an LFI vulnerability. An attacker can send a series of HTTP...

Unrestricted file upload

A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution when chained with an LFI vulnerability. An attacker can send a series of HTTP...

CVE-2023-49715

CVE-2023-49715 is an unrestricted PHP file upload vulnerability in WWBN AVideo’s import.json.php temporary copy function (commit 15fed957fb). The vulnerability allows an attacker to upload a PHP payload via the upload pathway and, in combination with a Local File Inclusion, could lead to arbitrar...

CVE-2023-49715

A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution when chained with an LFI vulnerability. An attacker can send a series of HTTP...

WebCopilot - An Automation Tool That Enumerates Subdomains Then Filters Out Xss, Sqli, Open Redirect, Lfi, Ssrf And Rce Parameters And Then Scans For Vulnerabilities

WebCopilot is an automation tool designed to enumerate subdomains of the target and detect bugs using different open-source tools. The script first enumerate all the subdomains of the given target domain using assetfinder, sublister, subfinder, amass, findomain, hackertarget, riddler and crt then...