CVE-2026-84069

The WebFacing Email Accounts for cPanel WordPress plugin (versions 5.3-5.3.6 ) is vulnerable to Local File Inclusion (LFI) . The root cause is a failure to restrict access to a bundled script and a lack of validation for a user-supplied path used to include a local file. This allows unauthenticat...

CVE-2026-84069 WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php

The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion...

CVE-2026-84069 WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php

The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion...

PT-2021-22243

Name of the Vulnerable Software and Affected Versions NASCENT RemKon Device Manager version 4.0.0.0 Description A command-injection issue in the Image Upload function allows attackers to execute arbitrary commands as root via shell metacharacters in the filename parameter to "assets/index.php"...

PT-2021-22245

Name of the Vulnerable Software and Affected Versions NASCENT RemKon Device Manager version 4.0.0.0 Description The issue concerns the assets/index.php Image Upload feature, which allows attackers to upload any code to the target system, resulting in remote code execution. The API endpoint...

CVE-2021-38613: Unrestricted Upload of File with Dangerous Type

The assets/index.php Image Upload feature of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to upload any code to the target system and achieve remote code execution...