CVE-2025-46468: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WPFable Fable Extra fable-extra allows PHP Local File Inclusion.This issue affects Fable Extra: from n/a through = 1.0.6...

PT-2025-22730 · Unknown +1 · Wpfable Fable Extra +1

Name of the Vulnerable Software and Affected Versions: WPFable Fable Extra versions 1.0.0 through 1.0.6 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File...

WordPress plugin Fable Extra SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

CVE-2022-1670

When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. It was possible to bypass this restriction of validity to create extra user accounts above the initial number of invited users...

CVE-2022-39119

In network service, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed...

CVE-2022-39111

In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no additional execution privileges needed...

CVE-2022-39098

In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...

CVE-2022-39113

In Music service, there is a missing permission check. This could lead to local denial of service in Music service with no additional execution privileges needed...

CVE-2022-39095

In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...

CVE-2022-39094

In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...

CVE-2022-39090

In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...

CVE-2022-39096

In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...

CVE-2022-39102

In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...

CVE-2022-39101

In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...

CVE-2022-39109

In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no additional execution privileges needed...

CVE-2022-37044

In Zimbra Collaboration Suite ZCS 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim's machine...

CVE-2022-3374

The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import intentionally or not a malicious Customizer Styling file and a suitable gadget chain is present on the blog...

CVE-2021-24936

The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings, nor sanitise and escape some of them, which could allow attackers to make a logged in admin change them and perform Cross-Site Scripting attacks...

CVE-2021-25110

The Futurio Extra WordPress plugin before 1.6.3 allows any logged in user, such as subscriber, to extract any other user's email address...

CVE-2021-21630

Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...