Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read

The Divi Plus WordPress plugin through 2.4.0 exposes the /wp-json/elicus/v1/dipl-modules/svg-animator REST route with a permission callback that returns true unconditionally, and passes the svgimage parameter to filegetcontents without any path restriction, so an unauthenticated attacker can read...

CVE-2024-27564

CVE-2024-27564 Description: A vulnerability in pictureproxy.php allows remote attackers to perform arbitrary requests by injecting URLs into the url parameter. This SSRF vulnerability can be exploited without authentication, making it particularly dangerous. The vulnerable code is in the...

CVE-2026-66491

Arbitrary File Read via getSource in PhocaCommander PhocaCommander ≤ 6.1.3 — Authenticated Admin Path Traversal, No CSRF Required SUMMARY An arbitrary file read vulnerability exists in PhocaCommander's file editor endpoint. The getSource function decodes a base64-encoded filename parameter and...

CVE-2024-45440

CVE-2024-45440 Drupal CVE-2024-45440 core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist. Usage python CVE-2024-45440.py Lab Deployment settings.php will replace the settings.ph...

SSRF-Exploit-CVE-2024-27564

SSRF-Exploit-CVE-2024-27564 Project Title This project demonstrates a Server-Side Request Forgery SSRF vulnerability in the pictureproxy.php file. Description A vulnerability in pictureproxy.php allows remote attackers to perform arbitrary requests by injecting URLs into the url parameter. This...

GHSA-2PHH-27FW-Q4GC PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

Summary PhpSpreadsheet's Worksheet\Drawing::setPath validates an external-image URL against an operator-supplied isWhitelisted callback once, on the initial URL only, then fetches it with filegetcontents using a stream context that does not set followlocation = 0. A whitelisted host that returns ...

PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

Summary PhpSpreadsheet's Worksheet\Drawing::setPath validates an external-image URL against an operator-supplied isWhitelisted callback once, on the initial URL only, then fetches it with filegetcontents using a stream context that does not set followlocation = 0. A whitelisted host that returns ...

CVE-2026-111234 SimplePie through 1.9.0 Local File Read via file:// Redirect

SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing filegetcontents to read...

CVE-2026-111234

The SimplePie library (through version 1.9.0 ) contains a local file read vulnerability. The root cause is the handling of file:// URLs within redirects or autodiscovery links, which can cause the file_get_contents() function to read files accessible to the web server process. Malicious feed serv...

SimplePie input validation vulnerability

SimplePie versions 1.9.0 and earlier have a vulnerability related to input validation errors. This vulnerability arises from improper handling of file:// URLs in redirection or auto-discovery links, allowing filegetcontents to read files accessible to the web server process, potentially leading t...

CVE-2026-108591 InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_upload Tool

InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with filescreate permission to read server files by abusing the AI Core MCP fileupload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to filegetcontents,...

CVE-2026-91136: Improper Limitation of a Pathname to a Restricted Directory

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svgimage' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback SVGAnimatorController::indexpermission...

InnoShop input validation error vulnerability

InnoShop version 0.9.2 has a vulnerability in input validation. This vulnerability stems from improper handling of the source parameter in the AI Core MCP fileUpload tool. It allows authenticated administrators with the filescreate permission to use the file:// or php:// stream wrapper to read...

VulnCheck KEV: CVE-2026-91136

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svgimage' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback SVGAnimatorController::indexpermission...

php_filter_chains_oracle_exploit

PHP filter chains: lettura di file da oracolo basato su errori Una CLI per sfruttare parametri affetti dalla lettura di file causata dall'oracolo basato su errori delle catene di filtri PHP. Può essere usata per esfiltrare il contenuto di un file locale quando viene passato a funzioni vulnerabili...

CVE-2026-56661

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches a user-supplied URL with filegetcontents after only format validation FILTERVALIDATEURL — there is no validation of the request destination...

EUVD-2026-91017

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches a user-supplied URL with filegetcontents after only format validation FILTERVALIDATEURL — there is no validation of the request destination...

CVE-2026-56661 GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches a user-supplied URL with filegetcontents after only format validation FILTERVALIDATEURL — there is no validation of the request destination...

CVE-2026-56661

The GetSimple CMS CE community edition, prior to version 1.5 , is vulnerable to a Server-Side Request Forgery (SSRF) in its update handler. The application uses file_get_contents() to fetch a user-supplied URL, performing only basic format validation via FILTER_VALIDATE_URL without verifying the ...

CVE-2026-56661

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches a user-supplied URL with filegetcontents after only format validation FILTERVALIDATEURL — there is no validation of the request destination...