discuz-ml-rce

discuz-ml-rce Sistemas e versões afetados: Discuz!ML V3.2-3.4 Discuz!x V3.2-3.4 Causa da vulnerabilidade: o sistema Discuz!ML não filtra o conteúdo do parâmetro language recebido pelo campo l no cookie, resultando em concatenação de strings e, consequentemente, execução de código PHP. Nos campos ...

CVE-2023-46304

CVE-2023-46304 Esecuzione di codice in modalità remota autenticata in VTiger Open Source CRM v7.5 Riepilogo Esiste una vulnerabilità nel modulo Users della versione attuale di VTiger CRM Open Source 7.5.0 che consente a un utente autenticato di scrivere ed eseguire codice PHP arbitrario in...

CVE-2026-78562

The Verdure Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used...

CVE-2026-78566

The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to...

EUVD-2026-65326

The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to...

EUVD-2026-65325

The Verdure Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used...

CVE-2023-30253-PoC

CVE-2023-30253 CVE-2023-30253 PoC Descrizione Questa è la mia PoC per la CVE-2023-30253 Dolibarr 17.0.0 PHP Code Injection: quando il plugin CMS Website core è abilitato, un attaccante autenticato può ottenere l'esecuzione remota di comandi tramite iniezione di codice PHP, bypassando le restrizio...

CVE-2024-6330

CVE-2024-6330 GEO my WordPress = 4.5.0.1 - Inclusione di File Locale non autenticata Descrizione Il plugin GEO my WP per WordPress è vulnerabile all'Inclusione di File Locale in tutte le versioni fino alla 4.5.0.1 inclusa tramite il parametro 'forminfowindowtemplatecontentpath'. Ciò consente a...

CVE-2026-78478

The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypas...

CVE-2026-78478

The Måne theme for WordPress is affected by an unauthenticated Local File Inclusion vulnerability in all versions up to and including 1.7 . An attacker can include and execute arbitrary files on the server, enabling execution of any PHP code within those files. This can be leveraged to bypass acc...

CVE-2026-78478 Måne <= 1.7 - Unauthenticated Local File Inclusion

The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypas...

CVE-2026-14280 Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the emoptionssave function. This makes it possible for authenticated attackers, with administrator-level access and above, to...

PT-2026-81178

Name of the Vulnerable Software and Affected Versions Mane theme for WordPress versions prior to 1.8 Description The Mane theme for WordPress contains a Local File Inclusion flaw. This allows unauthenticated attackers to include and execute arbitrary files on the server, which can lead to the...

PT-2026-81217

Name of the Vulnerable Software and Affected Versions Verdure Core versions prior to 1.3 Description The Verdure Core plugin for WordPress contains a Local File Inclusion flaw. This allows unauthenticated attackers to include and execute arbitrary files on the server, enabling the execution of PH...

CVE-2021-40964

Tiny File Manager = 2.4.6 - Esecuzione Remota di Codice Autenticato 🚨 Informazioni sull'Exploit Questo è un exploit Esecuzione Remota di Codice RCE autenticato basato su Bash per Tiny File Manager versioni = 2.4.6, vulnerabile sotto CVE-2021-40964. Lo script sfrutta: Validazione debole del...

CVE-2026-59989 Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...

CVE-2026-75963

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

CVE-2026-13405

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...

EUVD-2026-63201

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...

CVE-2026-13405 Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...