PT-2025-29747 · Unknown · Contact Form 7

Name of the Vulnerable Software and Affected Versions: HT Contact Form 7 versions n/a through 2.0.0 Description: The software contains an Improper Control of Filename for Include/Require Statement, also known as a PHP Remote File Inclusion issue. This allows for PHP Local File Inclusion...

ColdFusion XML File Read

The vulnerability of the ColdFusion software platform is related to errors in processing XML requests. Exploiting this vulnerability allows a malicious actor to read arbitrary files remotely...

CVE-2025-7477

A vulnerability, which was classified as critical, has been found in code-projects Simple Car Rental System 1.0. This issue affects some unknown processing of the file /admin/addcars.php. The manipulation of the argument image leads to unrestricted upload. The attack may be initiated remotely. Th...

CVE-2025-7470

A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been classified as critical. Affected is an unknown function of the file /pages/productadd.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The...

CVE-2025-44177

A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences...

CVE-2025-44177

A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences...

CVE-2025-44177

A directory traversal vulnerability (CWE-22) exists in White Star Software Protop version 4.4.2-2024-11-27 within the /pt3upd/ endpoint. An unauthenticated remote attacker can use encoded traversal sequences to read arbitrary files on the underlying operating system, potentially exposing sensitiv...

CVE-2025-44177: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences...

CVE-2025-44177

A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences...

Cisco ISE Passive Identity Connector Arbitrary File Load

The vulnerability of the application software interface of the Cisco Identity Services Engine ISE and the Cisco ISE Passive Identity Connector ISE-PIC, which acts as a virtual authentication data collection device, is related to deficiencies in access control. Exploiting this vulnerability could...

CVE-2025-6806

CVE-2025-6806 – Marvell QConvergeConsole decryptFile Directory Traversal : The vulnerability affects Marvell QConvergeConsole in the decryptFile method, where insufficient validation of a user-supplied path allows a remote attacker (no authentication required) to perform arbitrary file writes on ...

Marvell QConvergeConsole path traversal vulnerability

Marvell QConvergeConsole is a unified adapter management software across data centers from Marvell USA. A path traversal vulnerability exists in Marvell QConvergeConsole due to an error in the saveNICParamsToFile method. An attacker could exploit the vulnerability to write a file in the SYSTEM...

CVE-2025-49070

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in NasaTheme Elessi elessi-theme allows PHP Local File Inclusion.This issue affects Elessi: from n/a through 6.4.1...

Exploit for CVE-2025-49493

CVE-2025-49493 Akamai CloudTest - XXE Injection ☁️ 📄 Descr...

CVE-2025-49070

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in NasaTheme Elessi elessi-theme allows PHP Local File Inclusion.This issue affects Elessi: from n/a through 6.4.1...

PT-2025-27917 · Elessi · Elessi

Name of the Vulnerable Software and Affected Versions: Elessi affected versions not specified Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows for PHP Local File...

PT-2025-27914 · Unknown · Privatecontent - Mail Actions

Name of the Vulnerable Software and Affected Versions: PrivateContent - Mail Actions versions 2.3.2 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows P...

PT-2025-27911 · Cmsmasters · Cmsmasters Content Composer

Name of the Vulnerable Software and Affected Versions: CMSMasters Content Composer affected versions not specified Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion'. This allows PHP Local Fi...

D-Link DSL-2730U Web Interface File Read

The vulnerability in the web interface for managing D-Link DSL-2730U, DSL-2750U, and DSL-2750E microprogramming routers is related to insufficient validation of input data during the processing of the getpage parameter for the webproc endpoint /cgi-bin/webproc. Exploiting this vulnerability allow...

CVE-2025-34074

An authenticated remote code execution vulnerability exists in Lucee’s administrative interface due to insecure design in the scheduled task functionality. An administrator with access to /lucee/admin/web.cfm can configure a scheduled job to retrieve a remote .cfm file from an attacker-controlled...