CVE-2024-3122

CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privilege to read arbitrary file on the system...

CVE-2024-4498

A Path Traversal and Remote File Inclusion RFI vulnerability exists in the parisneo/lollms-webui application, affecting versions v9.7 to the latest. The vulnerability arises from insufficient input validation in the /applysettings function, allowing an attacker to manipulate the discussiondbname...

CVE-2024-4498

CVE-2024-4498 affects parisneo/lollms-webui (versions v9.7 to latest). The flaw is in the /apply_settings function, where insufficient input validation on the parameter discussion_db_name enables path traversal and Remote File Inclusion (RFI). The issue is worsened by a reported bypass of input f...

CVE-2024-5431

The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.25 via the reservationextrafield shortcode parameter. This makes it possible for authenticated...

CVE-2023-45197

The CVE-2023-45197 entry concerns Adminer and AdminerEvo where the file-upload plugin allows uploading a file with a table name of “..” to the Adminer directory root, enabling an attacker to guess the filename and execute it. Affected software: Adminer and AdminerEvo (Adminer is no longer support...

CVE-2024-6083

PHPVibe 11.0.46 contains a vulnerability in the Media Upload Page, specifically /app/uploading/upload-mp3.php. The issue arises from manipulation of the file argument, enabling unrestricted file uploads and allowing remote exploitation. The CVE (CVE-2024-6083) has been publicly disclosed, with VD...

CVE-2024-5577

The Where I Was, Where I Will Be plugin for WordPress is vulnerable to Remote File Inclusion in version = 1.1.1 via the WIWHEADER parameter of the /system/include/includeuser.php file. This makes it possible for unauthenticated attackers to include and execute arbitrary files hosted on external...

CVE-2024-5577

The Where I Was, Where I Will Be plugin for WordPress is vulnerable to Remote File Inclusion in version = 1.1.1 via the WIWHEADER parameter of the /system/include/includeuser.php file. This makes it possible for unauthenticated attackers to include and execute arbitrary files hosted on external...

CVE-2024-5577 Where I Was, Where I Will Be <= 1.1.1 - Unauthenticated Remote File Inclusion

The Where I Was, Where I Will Be plugin for WordPress is vulnerable to Remote File Inclusion in version = 1.1.1 via the WIWHEADER parameter of the /system/include/includeuser.php file. This makes it possible for unauthenticated attackers to include and execute arbitrary files hosted on external...

CVE-2024-5577 Where I Was, Where I Will Be <= 1.1.1 - Unauthenticated Remote File Inclusion

The Where I Was, Where I Will Be plugin for WordPress is vulnerable to Remote File Inclusion in version = 1.1.1 via the WIWHEADER parameter of the /system/include/includeuser.php file. This makes it possible for unauthenticated attackers to include and execute arbitrary files hosted on external...

CVE-2024-5577

CVE-2024-5577 affects the WordPress plugin “Where I Was, Where I Will Be” (versions

CVE-2024-4936

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This required allowurlinclude to be...

CVE-2024-4936

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This required allowurlinclude to be...

EUVD-2024-44502

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This required allowurlinclude to be...

CVE-2024-4936 Canto <= 3.0.8 - Unauthenticated Remote File Inclusion

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This required allowurlinclude to be...

CVE-2024-4936 Canto <= 3.0.8 - Unauthenticated Remote File Inclusion

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This required allowurlinclude to be...

CVE-2024-4936

CVE-2024-4936 affects the Canto WordPress plugin (versions ≤ 3.0.8). It allows unauthenticated Remote File Inclusion via the abspath parameter, requiring allow_url_include to be enabled to exploit, leading to potential code execution. Remediation per connected docs: upgrade to a version newer tha...

Wordpress Where I Was, Where I Will Be plugin <= 1.1.1 - Unauthenticated Remote File Inclusion vulnerability

Unauthenticated Remote File Inclusion vulnerability discovered by Jonas Höbenreich in WordPress Plugin Where I Was, Where I Will Be versions = 1.1.1...

Wordpress Canto plugin <= 3.0.8 - Unauthenticated Remote File Inclusion vulnerability

Unauthenticated Remote File Inclusion vulnerability discovered by Sushi Com Abacate in WordPress Plugin Canto versions = 3.0.8...

WordPress Where I Was, Where I Will Be Plugin <= 1.1.1 is vulnerable to Remote File Inclusion

Software Where I Was, Where I Will Be Type Plugin Vulnerable versions = 1.1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Remote File Inclusion CVE CVE-2024-5577 Patch priority Low CVSS severity Low 9 Developer Claim ownership PSID d67a5f36ea60 Credits Jonas Höbenreich Required privile...