GhostCat-LFI-exp

GhostCat-LFI-exp CVE-2020-1938 Original EXP: https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi Only modified one place, can include execute arbitrary files under any project...

CVE-2025-32432-POC

Craft CMS CVE-2025-32432 단일 대상 PoC 승인된 테스트만 허용됩니다. 이 저장소는 통제된 실습 환경, Hack The Box와 같은 CTF 플랫폼, 내부 검증 및 방어적 검증을 위한 것입니다. 귀하가 소유하지 않거나 명시적 테스트 허가를 받지 않은 시스템에 대해 실행하지 마십시오. 개요 이 프로젝트는 CVE-2025-32432 에 대한 단일 대상 개념 증명PoC을 포함하며, 이는 Craft CMS의 사전 인증 원격 코드 실행 문제입니다. PoC는 두 단계로 수행됩니다: 1. 취약점 확인 : Craft CM...

CVE-2026-21015-PHP-Filter-Chain-Arbitrary-File-Read

CVE-2026-21015 – PHP 필터 체인 임의 파일 읽기 프로그램 코드 PHP // vulnerable.php - Includes file based on user input via filter ?php $file = $GET'page'; // Attempt to sanitize by allowing only .php files, but vulnerable to filter wrapper include"php://filter/convert.base64-encode/resource=" . $file;...

WPSniper

WPSniper WordPress Core용 CVE-2026-87902 탐지기. getpagetemplate은 페이지 템플릿 해석이 활성 테마 외부의 읽기 가능한 로컬 .php 파일을 포함하도록 조작될 수 있습니다. WPSniper는 사이트를 핑거프린팅하고, 발행된 pageid를 선택하고, include 클래스를 프로브하며, 프로브 본문에만 고유한 강력한 PEAR 배너가 있을 때만 VULN 을 출력합니다. 탐지만. 웹셸 없음. pearcmd config-create 없음. OS 명령 실행 없음. python3 WPSniper....

CVE-2020-13886

PoC: https://youtu.be/nNKBRx8IglI ------------------------------------------------------------------------------------------------------------- ------------- 0day: IP 전화 TIP200/200 LITE & TIP 300 | 로컬 파일 포함 | ---------------------------- ------------------------------- P0c 작성자: Ls4ss...

Exploit for CVE-2026-11613

CVE-2026-11613 — Divi Ajax Filter RCE | | | |---|---| | Plug...

CVE-2026-79773 Winter CMS before 1.2.13 Local File Inclusion via JavaScript

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manageassets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can...

CVE-2026-15540

CVE-2026-15540 affects SourceCodester Online Book Store System 1.0. The Administrative Interface file /admin/index.php contains a vulnerability where manipulating the page parameter leads to improper control of the filename used in include/require statements in PHP, i.e., a local file inclusion. ...

PT-2026-56149

Name of the Vulnerable Software and Affected Versions WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell versions prior to 3.12.8 Description Unauthenticated attackers can achieve Remote Code Execution by sending unsanitized values through the postData parameter. The plug...

CVE-2026-44239: Improper Control of Filename for Include/Require Statement in PHP Program

FreePBX is an open source IP PBX. Prior to 16.0.22 and 17.0.5, the Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied input without path sanitization. The $REQUEST'rawname' parameter is concatenated into an include call with a .class.php suffix, allowing path...

Exploit for CVE-2020-1938

Tomcat Ghostcat CVE-2020-1938 / CNVD-2020-10487 Vulnerabilit...

CVE-2026-27048 WordPress The Aisle Core plugin <= 2.0.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes The Aisle Core theaisle-core allows PHP Local File Inclusion.This issue affects The Aisle Core: from n/a through = 2.0.5...

CVE-2026-32393

CVE-2026-32393 concerns the WordPress plugin Greenly Theme Addons (Creatives Planet/Creatives_Planet Greenly Theme Addons) with versions older than 8.2. The issue is an Improper Control of Filename for Include/Require Statement in PHP, enabling PHP Local File Inclusion due to what is described as...

CVE-2026-22434 WordPress Crown Art theme <= 1.2.11 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Crown Art crown-art allows PHP Local File Inclusion.This issue affects Crown Art: from n/a through = 1.2.11...

Exploit for CVE-2026-30480

CVE-2026-30480: LibreNMS Local File Inclusion LFI via Path T...

CVE-2019-16951

A remote file include RFI issue was discovered in Enghouse Web Chat 6.2.284.34. One can replace the localhost attribute with one's own domain name. When the product calls this domain after the POST request is sent, it retrieves an attacker's data and displays it. Also worth mentioning is the amou...

CVE-2025-62753

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in MadrasThemes MAS Videos masvideos allows PHP Local File Inclusion.This issue affects MAS Videos: from n/a through = 1.3.4...

PT-2025-53876

Name of the Vulnerable Software and Affected Versions Edge-Themes Cinerama - A WordPress Theme for Movie Studios and Filmmakers versions through 2.4 Description The software contains a PHP Local File Inclusion issue due to improper control of filename for include/require statements. This allows f...

CVE-2025-58894 WordPress Good Mood theme <= 1.16 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes Good Mood good-mood allows PHP Local File Inclusion.This issue affects Good Mood: from n/a through = 1.16...

WordPress plugin Etta 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...