WordPress Avaz Theme <= 2.8 is vulnerable to Local File Inclusion

Software Avaz Type Theme Vulnerable versions = 2.8 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-28944 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 1dc6fdd3ef9e Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity Required...

PT-2025-24530 · Unknown · Unfoldwp Blogprise

Name of the Vulnerable Software and Affected Versions: Unfoldwp Blogprise versions 1.0.0 through 1.0.9 Description: The issue is related to improper control of filename for include/require statement in PHP programs, also known as 'PHP Remote File Inclusion'. This allows PHP Local File Inclusion...

PT-2025-24563 · Hax Cms · Hax Cms

Name of the Vulnerable Software and Affected Versions: HAX CMS PHP versions prior to 11.0.0 Description: The issue is related to an authenticated Local File Inclusion LFI vulnerability in the HAXCMS saveOutline endpoint. This vulnerability allows a low-privileged user to read arbitrary files on t...

WordPress GrandPrix Theme <= 1.6 is vulnerable to Local File Inclusion

Software GrandPrix Type Theme Vulnerable versions = 1.6 Fixed in 1.6.1 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-49296 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID c52f8c6d6e9e Credits Bonds Required privilege Unauthenticated Publishe...

WordPress plugin Seofy Core 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

PT-2025-24537

Name of the Vulnerable Software and Affected Versions Mikado-Themes GrandPrix versions 1.6 and earlier Description The issue is related to a Path Traversal vulnerability that allows PHP Local File Inclusion. This vulnerability enables an attacker to access and potentially execute local files on t...

PT-2025-24466 · Ancorathemes · Ancorathemes Inset

Name of the Vulnerable Software and Affected Versions: AncoraThemes Inset versions 1.18.0 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local...

PT-2025-24498 · Magentech · Magentech Revo

Name of the Vulnerable Software and Affected Versions: magentech Revo versions 4.0.26 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. Th...

PT-2025-24536

Name of the Vulnerable Software and Affected Versions Mikado-Themes MediClinic versions n/a through 2.1 Description The issue is related to a Path Traversal vulnerability that allows PHP Local File Inclusion in Mikado-Themes MediClinic. Recommendations For versions n/a through 2.1, update to a...

PT-2025-24460 · WordPress · Bodycenter - Gym

Name of the Vulnerable Software and Affected Versions: BodyCenter - Gym, Fitness WooCommerce WordPress Theme versions n/a through 2.4 Description: The issue affects the BodyCenter - Gym, Fitness WooCommerce WordPress Theme, allowing for PHP Local File Inclusion due to improper control of filename...

PT-2025-24470 · Unknown · Valen - Sport

Name of the Vulnerable Software and Affected Versions: Valen - Sport, Fashion WooCommerce WordPress Theme versions n/a through 2.4 Description: The issue affects the Valen - Sport, Fashion WooCommerce WordPress Theme, allowing for PHP Local File Inclusion due to improper control of filename for...

WordPress plugin Inset 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A file inclusion vulnerability exists in the WordPress Inset plugin that stems from not doing effective filtering of local file resource calls, which can be exploited by an...

WordPress plugin Krowd 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A file inclusion vulnerability exists in the WordPress Krowd plugin that stems from not doing effective filtering of local file resource calls, which can be exploited by an...

WordPress CraftXtore Theme <= 1.7 is vulnerable to Local File Inclusion

Software CraftXtore Type Theme Vulnerable versions = 1.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-24770 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID db65eb0ec141 Credits Phat RiO - BlueRock Required privilege...

WordPress plugin Avaz 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A file inclusion vulnerability exists in the WordPress Avaz plugin that stems from not doing effective filtering of local file resource calls, which can be exploited by an...

PT-2025-24471 · Unknown · Snstheme Sns Anton

Name of the Vulnerable Software and Affected Versions: snstheme SNS Anton versions n/a through 4.1 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

WordPress plugin GrandPrix 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A path traversal vulnerability exists in the WordPress GrandPrix plugin that stems from not doing effective filtering of local file resource calls, which can be exploited by an...

WordPress Valen - Sport, Fashion WooCommerce WordPress Theme Theme <= 2.4 is vulnerable to Local File Inclusion

Software Valen - Sport, Fashion WooCommerce WordPress Theme Type Theme Vulnerable versions = 2.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-28945 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 05ab9d46b011 Credits Tran Nguye...

WordPress plugin Arlo 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. WordPress Arlo plugin has a path traversal vulnerability that stems from not doing effective filtering of resource calls, which can be exploited by an attacker to cause PHP loca...

HAX 安全漏洞

HAX is HAX The Web open source a HAX+CMS microsite managed using a PHP backend. A security vulnerability exists in HAX versions prior to 11.0.0 that stems from a local file inclusion vulnerability that could lead to the reading of sensitive files...