CVE-2025-0366

The Jupiter X Core plugin for WordPress is vulnerable to Local File Inclusion to Remote Code Execution in all versions up to, and including, 4.8.7 via the getsvg function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary...

CVE-2024-11010 FileOrganizer <= 1.1.4 - Authenticated (Administrator+) Local JavaScript File Inclusion

The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.1.4 via the 'defaultlang' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, ...

CVE-2024-3809

The Porto Theme – Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.9 via the ‘slideshowtype’ post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute...

CVE-2023-5250 Grid Plus <= 1.3.3 - Authenticated (Subscriber+) Local File Inclusion via Shortcode

The Grid Plus plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.3.3 via a shortcode attribute. This allows subscriber-level, and above, attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those file...

Iagona ScrutisWeb 代码问题漏洞

Iagona ScrutisWeb is a security solution from the French company Iagona. A code issue vulnerability exists in Iagona ScrutisWeb version 2.1.37 and prior versions. An attacker could exploit this vulnerability to upload and execute arbitrary files...

ExECM CoreB2B solution 输入验证错误漏洞

ExECM CoreB2B is provides a repeatable, proven People-Process-Technology model that scales IT teams and ensures operations stay in sync with B2B integration trends and requirements while improving business process optimization. A security vulnerability exists in the ExECM CoreB2B solution that...

CVE-2015-5952

Directory traversal vulnerability in Thomson Reuters for FATCA before 5.2 allows remote attackers to execute arbitrary files via the item parameter...

CVE-2016-4313

Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows remote attackers to execute arbitrary files via a .. dot dot in an archive file...

CVE-2015-4034

The createFromParcel method in the com.absolute.android.persistence.MethodSpec class in Samsung Galaxy S5s allows remote attackers to execute arbitrary files via a crafted Parcelable object in a serialized MethodSpec object...

Directory traversal

Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager CPPM before 6.4.5 allows remote administrators to execute arbitrary files via unspecified vectors...

Information disclosure

gpExec in GoPro HERO 3+ allows remote attackers to execute arbitrary files via a the 1 a1 or 2 a2 parameter in a start action...

CVE-2011-2508

Directory traversal vulnerability in libraries/displaytbl.lib.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1, when a certain MIME transformation feature is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in a...

CVE-2010-0967

Multiple directory traversal vulnerabilities in Geekhelps ADMP 1.01, when magicquotesgpc is disabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the style parameter to 1 colorvoid/footer.php, 2 default-green/footer.php, 3...

CVE-2009-2220

CVE-2009-2220 describes multiple directory traversal vulnerabilities in Tribiq CMS 5.0.12c—triggered when register_globals is enabled and magic_quotes_gpc is disabled—that allow remote inclusion/execution of arbitrary files via template_path in masthead.inc.php, toppanel.inc.php, contact.inc.php,...

CVE-2008-3677

Directory traversal vulnerability in includes/eventsapplicationtop.php in Freeway before 1.4.2.197 allows remote attackers to include and execute arbitrary local files via unspecified vectors...

Design/Logic Flaw

Apple Safari before 3.1.2 on Windows does not properly interpret the URLACTIONSHELLEXECUTEHIGHRISK Internet Explorer zone setting, which allows remote attackers to bypass intended access restrictions, and force a client system to download and execute arbitrary files...

CVE-2007-6471

Incomplete blacklist vulnerability in main.php in phPay 2.02.01 on Windows allows remote attackers to conduct directory traversal attacks and include and execute arbitrary local files via a ..\ dot dot backslash in the config parameter...

EUVD-2006-4708

Directory traversal vulnerability in admin.php in CCleague Pro Sports CMS 1.0.1 RC1 allows remote attackers to read and execute arbitrary local files via a .. dot dot sequence and trailing null %00 byte in the language Cookie parameter, as demonstrated by executing PHP code via a log file...