exploit-CVE-2015-8351

Gwolle Guestbook WordPress Plugin RFI Exploit This Python script exploits a critical Remote File Inclusion RFI vulnerability in the Gwolle Guestbook WordPress Plugin, which can be exploited by a non-authenticated attacker to include a remote PHP file and execute arbitrary code on the vulnerable...

CVE-2016-20101

Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value...

EUVD-2016-10918

Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value...

CVE-2016-20101

The Issuu Panel plugin for WordPress (versions before 1.6.6 ) is vulnerable to a PHP file inclusion vulnerability. An unauthenticated attacker can include remote or local files by sending a GET request to menu/documento/requests/ajax-docs.php with a crafted abspath parameter, which is insecurely ...

PT-2026-118684

Name of the Vulnerable Software and Affected Versions Issuu Panel plugin for WordPress versions prior to 1.6.6 Description An unauthenticated attacker can include remote or local files through the abspath parameter. This is achieved by sending GET requests to the...

CVE-2026-55540

CVE-2026-55540 is a path traversal vulnerability in PraisonAI , a multi-agent teams system. The function is_path_within_directory() relies on os.path.abspath() instead of os.path.realpath() to enforce the workspace boundary, so a symlink placed inside the workspace can resolve to a path outside i...

PT-2026-81329

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description PraisonAI contains path traversal flaws in its praisonai.code tool wrappers, which are intended to treat the workspace setting as a security boundary. The boundary is enforced inconsistently and...

WordPress WP-PageNavi - Full Path Disclosure Detection

WordPress WP-PageNavi plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress WP-PageNavi plugin files are publicly accessible without...

WordPress Plugin Hello Dolly - Full Path Disclosure Detection

WordPress Plugin Hello Dolly plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Hello Dolly plugin files are publicly accessibl...

WordPress Header Footer Elementor - Full Path Disclosure Detection

WordPress Header Footer Elementor plugin also known as Ultimate Addons for Elementor - Lite contains PHP files that lack proper ABSPATH protection, allowing direct access that reveals sensitive server path information via PHP error messages. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress...

WordPress UpdraftPlus - Full Path Disclosure Detection

WordPress Plugin UpdraftPlus files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin UpdraftPlus files are publicly accessible without...

WordPress Plugin SSL Insecure Content Fixer - Full Path Disclosure Detection

WordPress SSL Insecure Content Fixer plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress SSL Insecure Content Fixer plugin files are...

WordPress Contact Form - Full Path Disclosure Detection

WordPress Contact Form plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Contact Form plugin files are publicly accessible without...

PT-2026-49218

WordPress Brandfolder plugin version 3.0 and earlier contains a local file inclusion vulnerability in callback.php that allows unauthenticated attackers to include arbitrary files by manipulating the wp abspath parameter. Attackers can supply path traversal sequences or remote URLs through the wp...

EUVD-2018-21844

Simple Fields 0.2 through 0.3.5 WordPress Plugin contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting null bytes into the wpabspath parameter on PHP versions before 5.3.4. Attackers can supply malicious wpabspath values to...

PT-2026-41550

Simple Fields 0.2 through 0.3.5 WordPress Plugin contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting null bytes into the wp abspath parameter on PHP versions before 5.3.4. Attackers can supply malicious wp abspath values to simp...

EUVD-2009-0467

Malware in sbrugna...

WordPress plugin Advanced Custom Fields has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

CVE-2024-4936

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This required allowurlinclude to be...

CVE-2024-4936

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This required allowurlinclude to be...