23402 matches found
CVE-2026-28152: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Tonda Core 2.6 versions...
PT-2026-80843
Unauthenticated Local File Inclusion in Måne = 1.7 versions...
CVE-2026-28151: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Tonda 2.6 versions...
WordPress Events Made Easy plugin <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property vulnerability
Authenticated Contributor+ Local File Inclusion via 'wppagetemplate' Event Property vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Events Made Easy versions = 3.2.5...
GHSA-2223-F22X-24CQ Winter: Local File Inclusion through =include directives in JavaScript asset compilation
Impact Affected versions of Winter CMS allow authenticated backend users with the cms.manageassets permission "Manage website assets - images, JavaScript files, CSS files" to disclose arbitrary files readable by the PHP process by placing an =include / =require directive in a theme JavaScript...
Winter: Local File Inclusion through =include directives in JavaScript asset compilation
Impact Affected versions of Winter CMS allow authenticated backend users with the cms.manageassets permission "Manage website assets - images, JavaScript files, CSS files" to disclose arbitrary files readable by the PHP process by placing an =include / =require directive in a theme JavaScript...
GHSA-58FP-MCX6-7QF9 Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets
Impact Affected versions of Winter CMS allow authenticated backend users with the following permissions to disclose arbitrary files readable by the PHP process by injecting @import inline "" directives into LESS source that the backend compiles. Four entry points share the same root cause: - Bran...
Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets
Impact Affected versions of Winter CMS allow authenticated backend users with the following permissions to disclose arbitrary files readable by the PHP process by injecting @import inline "" directives into LESS source that the backend compiles. Four entry points share the same root cause: - Bran...
NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution
Executive Summary Two vulnerabilities were identified and chained to achieve authenticated remote code execution The first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk including the application directory itself by supplying an...
CVE-2026-28150
Unauthenticated Local File Inclusion in Golo Framework 1.7.5 versions...
CVE-2026-66586
Author Local File Inclusion in WP Cafe Pro 3.0.15 versions...
CVE-2025-15637
Unauthenticated Local File Inclusion in Shuffle = 1.8 versions...
CVE-2026-66586
WordPress WP Cafe Pro plugin (versions below 3.0.15) has a Local File Inclusion vulnerability, discovered by Ananda Dhakal of Patchstack. An authenticated author with high privileges can exploit it over the network to read sensitive server files, potentially compromising confidentiality, integrit...
EUVD-2026-63333
Author Local File Inclusion in WP Cafe Pro 3.0.15 versions...
CVE-2026-66586 WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability
Author Local File Inclusion in WP Cafe Pro 3.0.15 versions...
CVE-2026-66586 WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability
Author Local File Inclusion in WP Cafe Pro 3.0.15 versions...
CVE-2026-28150 WordPress Golo Framework plugin < 1.7.5 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Golo Framework 1.7.5 versions...
CVE-2026-28150
The Golo Framework WordPress plugin (versions before 1.7.5) contains an unauthenticated Local File Inclusion vulnerability. CVSS 3.1 scores it HIGH (8.1) with network attack vector, no privileges or user interaction required. Affected sites should upgrade to version 1.7.5 immediately. No in-the-w...