CVE-2025-56520

CVE-2025-56520 : Dify v1.6.0 contains a Server-Side Request Forgery (SSRF) in the controllers.console.remote_files.RemoteFileUploadApi due to improper validation. The Nuclei template and VulnCheck/Red Hat/NVD/CNNVD entries confirm an SSRF that allows the server to make arbitrary requests from its...

CVE-2025-56520

Dify v1.6.0 was discovered to contain a Server-Side Request Forgery SSRF via the component controllers.console.remotefiles.RemoteFileUploadApi. A different vulnerability than CVE-2025-29720...

dify 安全漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A security vulnerability exists in version 1.6.0 of dify, which stems from a server-side request forgery in the controllers.console.remotefiles.RemoteFileUploadApi component, which could lead to a server-side...

PT-2025-40009

Name of the Vulnerable Software and Affected Versions Dify version 1.6.0 Description The software contains a Server-Side Request Forgery SSRF issue. This occurs through the component controllers.console.remote files.RemoteFileUploadApi. The issue is distinct from CVE-2025-29720. Recommendations A...

CVE-2025-60150

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in wpshuffle Subscribe to Download subscribe-to-download allows PHP Local File Inclusion.This issue affects Subscribe to Download: from n/a through = 2.0.9...

CVE-2025-60126

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in PluginOps Testimonial Slider testimonial-add allows PHP Local File Inclusion.This issue affects Testimonial Slider: from n/a through = 3.5.8.6...

CVE-2025-60126

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in PluginOps Testimonial Slider testimonial-add allows PHP Local File Inclusion.This issue affects Testimonial Slider: from n/a through = 3.5.8.6...

CVE-2025-60150 WordPress Subscribe to Download plugin <= 2.0.9 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in wpshuffle Subscribe to Download subscribe-to-download allows PHP Local File Inclusion.This issue affects Subscribe to Download: from n/a through = 2.0.9...

CVE-2025-60126

CVE-2025-60126 is a PHP Local File Inclusion in the WordPress plugin Testimonial Slider (aka Testimonial Slider – Free Testimonials Slider Plugin). The issue is described as an Imporper Control of Filename for Include/Require Statement (PHP Remote File Inclusion) affecting plugin versions from 0 ...

PT-2025-39593

Name of the Vulnerable Software and Affected Versions wpshuffle Subscribe to Download versions through 2.0.9 Description The software contains an Improper Control of Filename for Include/Require Statement issue, also known as a PHP Remote File Inclusion. This allows for PHP Local File Inclusion...

PT-2025-39595

Name of the Vulnerable Software and Affected Versions wpshuffle Subscribe To Unlock versions through 1.1.5 Description The software contains a flaw related to improper control of filename for include/require statements, specifically a PHP Local File Inclusion issue. This allows for the inclusion ...

CVE-2025-57925

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in immonex immonex Kickstart Team immonex-kickstart-team allows PHP Local File Inclusion.This issue affects immonex Kickstart Team: from n/a through = 1.6.9...

CVE-2025-59588

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in PenciDesign Soledad soledad allows PHP Local File Inclusion.This issue affects Soledad: from n/a through = 8.6.8...

CVE-2025-58973

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows PHP Local File Inclusion.This issue affects Easy Elementor Addons: from n/a through = 2.2.8...

CVE-2025-59588 WordPress Soledad Theme <= 8.6.8 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in PenciDesign Soledad allows PHP Local File Inclusion. This issue affects Soledad: from n/a through 8.6.8...

CVE-2025-53450 WordPress Easy Pricing Table WP Plugin <= 1.1.3 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Pluginwale Easy Pricing Table WP easy-pricing-table-wp allows PHP Local File Inclusion.This issue affects Easy Pricing Table WP: from n/a through = 1.1.3...

PT-2025-39058

Name of the Vulnerable Software and Affected Versions PenciDesign Soledad versions through 8.6.8 Description The software contains a flaw related to improper control of filename for include/require statements, specifically a PHP Local File Inclusion issue. This allows for the inclusion of local...

PT-2025-38776

Name of the Vulnerable Software and Affected Versions immonex Kickstart Team versions through 1.6.9 Description The software contains a flaw related to improper control of filename for include/require statements, specifically a PHP Remote File Inclusion issue. This allows for PHP Local File...

PT-2025-39030

Name of the Vulnerable Software and Affected Versions Easy Elementor Addons versions through 2.2.8 Description An issue exists in hashthemes Easy Elementor Addons that allows for PHP Local File Inclusion due to improper control of filename for include/require statements. This can potentially lead...

CVE-2025-10772 huggingface LeRobot ZeroMQ Socket lekiwi_remote.py missing authentication

A vulnerability was identified in huggingface LeRobot up to 0.3.3. Affected by this vulnerability is an unknown functionality of the file lerobot/common/robotdevices/robots/lekiwiremote.py of the component ZeroMQ Socket Handler. The manipulation leads to missing authentication. The attack can onl...