CVE-2026-15667

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'eventlayout' parameter parameter. This makes it possible for authenticated attackers, with...

CVE-2026-15667

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is affected by a Local File Inclusion vulnerability in all versions up to and including 4.1.22 , exploitable via the event_layout parameter. Because the etn_manage_event capability is assigned to...

CVE-2026-15667 Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'eventlayout' parameter parameter. This makes it possible for authenticated attackers, with...

EUVD-2026-74568

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'eventlayout' parameter parameter. This makes it possible for authenticated attackers, with custom-level...

CVE-2018-16370

CVE-2018-16370 PESCMS Team 2.2.1 では、ZIP アーカイブ内に .php ファイルを配置することで、攻撃者が /Public/?g=Team&m=Setting&a=upgrade を通じて任意の PHP コードをアップロードおよび実行できる可能性があります。詳細は https://github.com/lazyphp/PESCMS-TEAM/issues/2 を参照してください。...

CVE-2025-2294

🚨 Kubio AI Page Builder = 2.5.1 - 인증되지 않은 로컬 파일 포함 📝 설명 WordPress용 Kubio AI Page Builder 플러그인은 kubiohybridthemeloadtemplate 함수를 통해 2.5.1 이하의 모든 버전에서 로컬 파일 포함Local File Inclusion 취약점에 노출됩니다. 이를 통해 인증되지 않은 공격자가 서버의 임의 파일을 포함하고 실행할 수 있으며, 해당 파일에 포함된 모든 PHP 코드가 실행될 수 있습니다. 이 취약점은 접근 제어를 우회하고, 민감한 데이터...

EUVD-2026-74173

The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process...

discuz-ml-rce

discuz-ml-rce 影響を受けるシステムとバージョン：Discuz!ML V3.2-3.4 Discuz!x V3.2-3.4 脆弱性の原因：Discuz!ML システムはcookie内のlで受け取ったlanguageパラメータの内容をフィルタリングしないため、文字列が連結され、PHPコードが実行されます。 cookieフィールド内にxxxxxxxxlanguageフィールドが現れます。根本原因はこのフィールドにインジェクションが存在し、RCEを引き起こすことです。 パケットキャプチャでcookieのlanguageの値を見つけ、次の値に変更します...

CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26

CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26 CVE-2024-25641 向けの完全自動化エクスプロイト。 ユーザーが認証されている場合、Cacti バージョン 1.2.26 は任意ファイル書き込みの脆弱性（「パッケージインポート」機能を介して悪用可能）に対して脆弱であり、 「Import Templates」権限を持つ認証済みユーザーが Web サーバー上で任意の PHP コードを実行（RCE）できるようになります。 この PoC のクレジット：...

RCE_CVE-2024-7954-

RCECVE-2024-7954- Плагин porteplume, используемый SPIP до версий 4.30-alpha2, 4.2.13 и 4.1.16, уязвим для удаленного выполнения произвольного кода. Удаленный неаутентифицированный злоумышленник может выполнить произвольный PHP-код от имени пользователя SPIP, отправив специально сформированный...

CVE-2021-44967

CVE-2021-44967 root@kitploit: Exploit Title: LimeSurvey 5.2.4 - Authenticated Remote Code Execution RCE Google Dork: inurl:limesurvey/index.php/admin/authentication/sa/login Date: 05/12/2021 Discovered by: Y1LD1R1M Exploit Author: D3Ext Vendor Homepage: https://www.limesurvey.org/ Software Link:...

CVE-2024-25641

CVE-2024-25641 Cacti 1.2.26 用 RCE このリポジトリは、Cacti 1.2.26 における CVE-2024-25641 の悪用プロセスを自動化します。 ユーザーが認証されている場合、「Package Import」機能を介して悪用可能な任意のファイル書き込みの脆弱性により、「Import Templates」権限を持つ認証ユーザーが Web サーバー上で任意の PHP コードを実行 RCE できるようになります。 オリジナルレポート:...

Invision Community <=5.0.6 Unauthenticated RCE via Template Injection

Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller /applications/core/modules/front/system/themeeditor.php, where a protected method named customCss can be invoked by unauthenticated...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Эксплойт удаленного выполнения кода в Pterodactyl Panel HTB Season 10 - Разбор машины Pterodactyl Обзор Цель: Pterodactyl HTB Machine Средняя сложность CVE: CVE-2025-49132 Критичность: Критическая CVSS 9.8 Тип атаки: Неаутентифицированное удаленное выполнение кода Затронуто:...

CVE-2026-78562

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...

CVE-2026-78566

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...

EUVD-2026-65326

The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to...

CVE-2026-78566

...

EUVD-2026-65325

The Verdure Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used...

CVE-2026-78478

The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypas...