CVE-2026-15244: Improper Limitation of a Pathname to a Restricted Directory

The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and execution of arbitrary local files, which is then triggered o...

PT-2020-14038

Name of the Vulnerable Software and Affected Versions OpenClinic GA versions 5.09.02 through 5.89.05b Description The issue allows for the disclosure of sensitive files or the execution of malicious uploaded files by executing arbitrary local files specified within its parameter. This could...

PT-2017-6261

Name of the Vulnerable Software and Affected Versions Wonder CMS version 2014 Description A directory traversal issue in index.php allows remote attackers to include and execute arbitrary local files by crafting a theme. Recommendations For Wonder CMS version 2014, consider restricting access to...

PT-2015-6937

Name of the Vulnerable Software and Affected Versions GD bbPress Attachments plugin versions prior to 2.3 Description The issue allows remote administrators to include and execute arbitrary local files. This can be achieved by using a .. dot dot in the tab parameter in the "gdbbpress attachments"...

PT-2014-8761

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.0.x through 4.0.10.5 phpMyAdmin versions 4.1.x through 4.1.14.6 phpMyAdmin versions 4.2.x through 4.2.11 Description The issue allows remote authenticated users to include and execute arbitrary local files via a crafted...

PT-2014-6213

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.17 ownCloud Server versions 6.0.x prior to 6.0.4 Description A directory traversal issue exists in the routing component, allowing remote attackers to include and execute arbitrary local files by using a...

PT-2012-3431

Name of the Vulnerable Software and Affected Versions phpPaleo versions 4.8b155 and earlier Description The issue allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter of the index.php file. This is a directory traversal vulnerability...

PT-2012-2992

Name of the Vulnerable Software and Affected Versions ImpressCMS versions 1.2.x through 1.2.6 and versions 1.3.x through 1.3.0 Description The issue allows remote authenticated users to include and execute arbitrary local files. This is achieved by exploiting a directory traversal vulnerability i...

PT-2012-5715

Name of the Vulnerable Software and Affected Versions AneCMS affected versions not specified Description The issue allows remote attackers to include and execute arbitrary local files via a .. dot dot in the p parameter in the "acp/index.php" endpoint. Recommendations At the moment, there is no...

PT-2012-3893

Name of the Vulnerable Software and Affected Versions PluXml versions prior to 5.1.6 Description The issue allows remote attackers to include and execute arbitrary local files. This is achieved by exploiting a directory traversal vulnerability in the update/index.php file. The vulnerability can b...

PT-2012-3881

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.3.4 Description The issue allows remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter of the upgrade.php file. Recommendations For versions prior to 2.3.4, update t...

PT-2012-4041

Name of the Vulnerable Software and Affected Versions Pligg CMS versions prior to 1.2.2 Description The issue allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the captcha parameter to "module.php". This can be exploited through cross-site request...

PT-2012-3583

Name of the Vulnerable Software and Affected Versions AjaXplorer versions 3.2.x through 3.2.4 AjaXplorer versions 4.0.x through 4.0.3 Description The issue allows remote attackers to include and execute arbitrary local files via a .. dot dot in the pluginName or pluginPath parameter in a "get...

PT-2011-4978

Name of the Vulnerable Software and Affected Versions osCommerce version 3.0.2 Description The issue allows remote attackers to include and execute arbitrary local files via directory traversal vulnerabilities. This can be achieved by manipulating the set or module parameter in various PHP files,...

CVE-2011-2718

Multiple directory traversal vulnerabilities in the relational schema implementation in phpMyAdmin 3.4.x before 3.4.3.2 allow remote authenticated users to include and execute arbitrary local files via directory traversal sequences in an export type field, related to 1...

PT-2011-2417

Name of the Vulnerable Software and Affected Versions LotusCMS Fraise version 3.0 Description A directory traversal issue exists in the core/lib/router.php file of LotusCMS Fraise. This issue allows remote attackers to include and execute arbitrary local files when the magic quotes gpc setting is...

PT-2010-5579

Name of the Vulnerable Software and Affected Versions Hycus CMS version 1.0.3 Description The issue allows remote attackers to include and execute arbitrary local files. This is achieved by exploiting directory traversal vulnerabilities using a .. dot dot in the "site" parameter to specific API...

PT-2010-5422

Name of the Vulnerable Software and Affected Versions Pulse CMS Basic versions prior to 1.2.9 Description The issue allows remote attackers to include and execute arbitrary local files. This is achieved by using a .. dot dot in the p parameter to "index.php". Recommendations For versions prior to...

PT-2010-5400

Name of the Vulnerable Software and Affected Versions Pandora FMS versions prior to 3.1.1 Description The issue allows remote attackers to include and execute arbitrary local files via specific parameters in various PHP files. This can be achieved through the "page" parameter to "ajax.php", the...

PT-2010-4300

Name of the Vulnerable Software and Affected Versions CMS Made Simple versions prior to 1.8.1 Description A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files. This is achieved by using a .. dot dot in the default cms lang parameter to an admi...