WebExploitation-Notes

BookSheetCTF - Web Security CheatSheet & Concept Guide Selama...

ronin-exploits

ronin-exploits !CIhttps://github.com/ronin-rb/ronin-explo...

CVE-2026-66710: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in e2pdf = 1.32.40 versions...

WordPress e2pdf plugin <= 1.32.40 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Noman Riffat in WordPress Plugin e2pdf versions = 1.32.40...

Security Bulletin:PyJWT CVE-2023-40254: Local File Inclusion & Server-Side Request Forgery via PyJWKClient uri Argument

Summary PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently...

Exploit for Incorrect Default Permissions in Samsung Android

--- CVE-2026-21015 – PHP Filter Chain Arbitrary File Read...

EUVD-2026-52560

An unauthenticated path traversal LFI vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory...

CVE-2026-56845

An unauthenticated path traversal LFI vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory...

CVE-2026-56845

An unauthenticated path traversal LFI vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory...

PT-2026-67573

An unauthenticated path traversal LFI vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory...

WordPress Photocart Link plugin <= 1.6 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by CrashBandicot @DosPerl in WordPress Plugin Photocart Link versions = 1.6...

WordPress Brandfolder plugin <= 3.0 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by AMAR^SHG in WordPress Plugin Brandfolder versions = 3.0...

WordPress WP with Spritz plugin <= 1.0 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by Wadeek in WordPress Plugin WP with Spritz versions = 1.0...

WordPress Dharma Booking plugin <= 2.28.3 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by AMAR^SHG in WordPress Plugin Dharma Booking versions = 2.28.3...

CVE-2026-17605

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaidpaymentformelement function. This makes it possible for authenticated attackers, with administrator-level acces...

CVE-2026-17605 Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaidpaymentformelement function. This makes it possible for authenticated attackers, with administrator-level acces...

CVE-2026-17605 Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaidpaymentformelement function. This makes it possible for authenticated attackers, with administrator-level acces...

CVE-2026-17605

CVE-2026-17605 affects the WordPress plugin Payment forms, Buy now buttons, and Invoicing System | GetPaid, up to version 2.8.56. It is a Local File Inclusion vulnerability in the getpaid_payment_form_element function, enabling an authenticated attacker with administrator-level access to include ...

CVE-2026-17605

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaidpaymentformelement function. This makes it possible for authenticated attackers, with administrator-level acces...

EUVD-2026-51757

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaidpaymentformelement function. This makes it possible for authenticated attackers, with administrator-level acces...