CVE-2026-65477 WordPress Tonda Core plugin <= 2.1.2 - Local File Inclusion vulnerability

Contributor Local File Inclusion in Tonda Core = 2.1.2 versions...

CVE-2026-65477

CVE-2026-65477 affects the WordPress Tonda Core plugin, version ≤ 2.1.2, with a Local File Inclusion vulnerability. Root cause: LFI in Tonda Core ≤ 2.1.2. Impact includes high confidentiality, integrity, and availability risk (CVSS 3.1: 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation stat...

EUVD-2026-48088

Contributor Local File Inclusion in Tonda Core = 2.1.2 versions...

CVE-2026-65477: Improper Control of Filename for Include/Require Statement in PHP Program

Contributor Local File Inclusion in Tonda Core = 2.1.2 versions...

PT-2026-63902

Contributor Local File Inclusion in Vino = 1.9 versions...

CVE-2026-65481: Improper Control of Filename for Include/Require Statement in PHP Program

Contributor Local File Inclusion in Vino = 1.9 versions...

PT-2026-63898

Contributor Local File Inclusion in Tonda Core = 2.1.2 versions...

GO-2026-6032 Gitea: Local File Inclusion via file:// URI in Migration Restore in gitea.dev

Gitea: Local File Inclusion via file:// URI in Migration Restore in gitea.dev...

Exploit for Command Injection in Grafana

CVE-2024-9264 - Grafana SQL Expressions DuckDB LFI/RCE PoC Py...

WordPress Vino theme <= 1.9 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Vino versions = 1.9...

WordPress Tonda Core plugin <= 2.1.2 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Tonda Core versions = 2.1.2...

Gitea: Local File Inclusion via file:// URI in Migration Restore

Local File Inclusion via file:// URI in Migration Restore Target: go-gitea/gitea Component: services/migrations/giteauploader.go, modules/uri/uri.go Severity: High Affected Versions: = v1.22.x all releases, master as of latest commit Researchers: - Isa Can — Eresus Security...

📄 WordPress LearnPress 4.2.6.8.1 LFI / Remote Code Execution

WordPress LearnPress plugin version 4.2.6.8.1 contains an authenticated Contributor+ local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is...

📄 WordPress Ajax Filter Posts (GridMaster) 3.4.11 Unauthenticated Local File Inclusion / Code Execution

WordPress Ajax Filter Posts GridMaster plugin version 3.4.11 contains an unauthenticated local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is...

📄 WordPress Age Gate 3.5.2 Unauthenticated LFI / Remote Code Execution

WordPress Age Gate plugin version 3.5.2 contains an unauthenticated local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is already present. This...

📄 WordPress News and Blog Designer Bundle 1.1 LFI / Remote Code Execution

WordPress News and Blog Designer Bundle plugin version 1.1 contains an unauthenticated local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is...

📄 WordPress Category Ajax Filter 2.8.2 Unauthenticated Local File Inclusion / Code Execution

WordPress Category Ajax Filter plugin version 2.8.2 contains an unauthenticated local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is already...

Gitea: Local File Inclusion via file:// URI in Migration Restore

Gitea's restore-repo command processes release.yml files from a user-supplied archive. The DownloadURL field in each release attachment is passed to uri.Open without scheme validation. Because uri.Open supports the file:// scheme via os.Open, an operator-level attacker can plant a crafted...

CVE-2026-9587

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997. The playfile functionality accepts user-controlled input through the soundpath parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying...

CVE-2026-9587

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997. The playfile functionality accepts user-controlled input through the soundpath parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying...