PT-2024-35744

Name of the Vulnerable Software and Affected Versions The Responsive Owl Carousel for Elementor plugin for WordPress versions up to, and including, 1.2.0 Description The issue allows authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on th...

CVE-2024-3499

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.0 via the generatenavigationmarkup function of the Onepage Scroll module. This makes it possible for authenticated attackers, with contributor-level access and...

VulnCheck KEV: CVE-2022-4328

The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server...

PT-2023-30808

Name of the Vulnerable Software and Affected Versions Softnext Mail SQR Expert affected versions not specified Description The issue is a Local File Inclusion LFI vulnerability in a special URL, allowing an unauthenticated remote attacker to execute arbitrary PHP files with .asp file extension...

CVE-2023-5815 News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Remote Code Execution via Local File Inclusion

The News & Blog Designer Pack – WordPress Blog Plugin — Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry plugin for WordPress is vulnerable to Remote Code Execution via Local File Inclusion in all versions up to, and including, 3.4.1 via the bdpgetmorepost...

CVE-2023-5250

The Grid Plus plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.3.2 via a shortcode attribute. This allows subscriber-level, and above, attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those file...

Unrestricted File Upload

responsive-filemanager,is vulnerable to Unrestricted File Upload. The vulnerability exists due to a lack of file upload checks, which allows an attacker with a low-privileged account to upload and execute arbitrary php files...

CVE-2022-27257

A PHP Local File Inclusion vulneraility in the default Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arbitrary php files via the schema parameter...

CVE-2022-27256

A PHP Local File inclusion vulnerability in the Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arbitrary php files via the schema parameter...

CVE-2022-27256

A PHP Local File inclusion vulnerability in the Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arbitrary php files via the schema parameter...

CVE-2022-27256

A PHP Local File inclusion vulnerability in the Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arbitrary php files via the schema parameter...

PT-2022-13185

Name of the Vulnerable Software and Affected Versions The Catch Themes Demo Import WordPress plugin versions prior to 2.1.1 Description The issue allows high privilege admins to upload arbitrary PHP files, potentially leading to remote code execution RCE, even when the blog is hardened with...

CVE-2021-25053

The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include arbitrary file with PHP extension as well as with data:// or http:// protocols, thus leading to CSRF RCE...

PT-2021-23441

Name of the Vulnerable Software and Affected Versions Socomec REMOTE VIEW PRO version 2.0.41.4 Description An issue was discovered in the firmware update form, allowing an authenticated attacker to bypass a client-side file-type check and upload arbitrary .php files. Recommendations For Socomec...

CVE-2021-41870: Unrestricted Upload of File with Dangerous Type

An issue was discovered in the firmware update form in Socomec REMOTE VIEW PRO 2.0.41.4. An authenticated attacker can bypass a client-side file-type check and upload arbitrary .php files...

ROS-2-794

2.794 Multiple Vulnerabilities in Moodle 1. Vulnerability description: The vulnerability discovered allows a remote attacker to perform cross-site scripting XSS attacks. The vulnerability allows a remote user to gain unauthorized access to other restricted features. Vulnerability allows a remote...

PT-2021-3934

Name of the Vulnerable Software and Affected Versions Contao versions prior to 4.4.56 Contao versions prior to 4.9.18 Contao versions prior to 4.11.7 Description The issue is related to incorrect code generation management in Contao, allowing an attacker to load arbitrary PHP files via insert tag...

CVE-2021-24253

The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to...

CVE-2020-8803

SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files within the webroot via addtoprospectlist...

CVE-2020-8803: Improper Limitation of a Pathname to a Restricted Directory

SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files within the webroot via addtoprospectlist...