EUVD-2026-64789

Unauthenticated Local File Inclusion in Verdure Core = 1.2 versions...

CVE-2026-66671

An unauthenticated Local File Inclusion (LFI) vulnerability affects the WordPress plugin Verdure Core in versions

CVE-2025-1661

CVE-2025-1661 – Unauthentifizierte Local File Inclusion LFI in HUSKY – Products Filter Professional für WooCommerce Beschreibung Das HUSKY – Products Filter Professional für WooCommerce -Plugin für WordPress ist in allen Versionen bis einschließlich 1.3.6.5 anfällig für Local File Inclusion LFI...

CVE-2026-16475-PoC

CVE-2026-16475 - PoC LFI OCSinventory Vulnerabilità di Local File Inclusion in OCSinventory 2.12.4 Dettagli della vulnerabilità CVE ID: CVE-2026-16475 Punteggio CVSS: 6.9 Medio CWE: CWE-98 Controllo improprio del nome file per l'istruzione Include/Require in un programma PHP Versione interessata:...

CVE-2018-7422

CVE-2018-12613 Bug di inclusione locale di file dovuto alla mancanza di sanificazione dell'input utente. Software vulnerabile 1. Wordpress Plugin: Site-Editor v.1.1.1; Come usare Questo script PowerShell necessita di due parametri per creare una richiesta HTTP di exploit: root@kitploit: 1. Endpoi...

PT-2026-81050

Name of the Vulnerable Software and Affected Versions MagicAI for WordPress versions 1.4 and earlier Description A Local File Inclusion issue exists that allows users with Subscriber privileges to read arbitrary files on the server. Recommendations Update MagicAI for WordPress to a version later...

PT-2026-80843

Unauthenticated Local File Inclusion in Måne = 1.7 versions...

lazyrecon

root@kitploit: | | | |/ | /| | | | / / |/ | \ | | | / / | | | | | | / | | | ||\ |/ \ || ||/|| |v2 |/ Lazyrecon v2 è uno strumento di scoperta di sottodomini che trova e risolve sottodomini validi, quindi esegue fuzzing SSRF/LFI/SQLi, brute-force e scansione delle porte. Ha un'architettura...

GHSA-2223-F22X-24CQ Winter: Local File Inclusion through =include directives in JavaScript asset compilation

Impact Affected versions of Winter CMS allow authenticated backend users with the cms.manageassets permission "Manage website assets - images, JavaScript files, CSS files" to disclose arbitrary files readable by the PHP process by placing an =include / =require directive in a theme JavaScript...

Winter: Local File Inclusion through =include directives in JavaScript asset compilation

Impact Affected versions of Winter CMS allow authenticated backend users with the cms.manageassets permission "Manage website assets - images, JavaScript files, CSS files" to disclose arbitrary files readable by the PHP process by placing an =include / =require directive in a theme JavaScript...

Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets

Impact Affected versions of Winter CMS allow authenticated backend users with the following permissions to disclose arbitrary files readable by the PHP process by injecting @import inline "" directives into LESS source that the backend compiles. Four entry points share the same root cause: - Bran...

NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution

Executive Summary Two vulnerabilities were identified and chained to achieve authenticated remote code execution The first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk including the application directory itself by supplying an...

CVE-2026-28150

Unauthenticated Local File Inclusion in Golo Framework 1.7.5 versions...

CVE-2026-66586

Author Local File Inclusion in WP Cafe Pro 3.0.15 versions...

CVE-2025-15637

Unauthenticated Local File Inclusion in Shuffle = 1.8 versions...

EUVD-2026-63333

Author Local File Inclusion in WP Cafe Pro 3.0.15 versions...

CVE-2026-66586

WordPress WP Cafe Pro plugin (versions below 3.0.15) has a Local File Inclusion vulnerability, discovered by Ananda Dhakal of Patchstack. An authenticated author with high privileges can exploit it over the network to read sensitive server files, potentially compromising confidentiality, integrit...

CVE-2026-66586 WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability

Author Local File Inclusion in WP Cafe Pro 3.0.15 versions...

CVE-2026-28150 WordPress Golo Framework plugin < 1.7.5 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Golo Framework 1.7.5 versions...

CVE-2026-28150

The Golo Framework WordPress plugin (versions before 1.7.5) contains an unauthenticated Local File Inclusion vulnerability. CVSS 3.1 scores it HIGH (8.1) with network attack vector, no privileges or user interaction required. Affected sites should upgrade to version 1.7.5 immediately. No in-the-w...