11115 matches found
CVE-2026-48768
TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is unauthenticated and uses unsanitized fileName input to construct public/ S3 object keys, while issuing presigned PUT URLs that do not bind Content-Type. As a result, any...
CVE-2026-54814
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109...
EUVD-2026-37709
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109...
CVE-2026-54814 WordPress Motors plugin <= 1.4.109 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109...
SUSE CVE-2026-24895
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP's CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index for finding .php on a lowercased copy of the request path but applies that byte index to the...
CVE-2025-69150: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Medeus = 1.14 versions...
CVE-2026-39590: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Atomlab = 2.4.5 versions...
CVE-2026-40721: Improper Control of Filename for Include/Require Statement in PHP Program
Contributor Local File Inclusion in Element Pack Pro = 9.0.6 versions...
CVE-2026-39549: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Aperitif = 1.5 versions...
CVE-2026-34895: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Softlab Core 1.2.11 versions...
CVE-2026-22338: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in EcoBlue = 1.15 versions...
CVE-2025-69149: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Top Dog = 1.0.5 versions...
CVE-2025-69160: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Gita = 1.11 versions...
CVE-2025-69167: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Eros = 1.3 versions...
CVE-2025-69174: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Etude = 1.6 versions...
CVE-2025-49403: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Arbitrary File Download in Premium Age Verification / Restriction for WordPress = 3.0.2 versions...
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Overview yt-dlp is an A youtube-dl fork with additional features and patches Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via insufficient sanitization of input passed to the aria2c external...
python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
Summary parseoptionsheader parsed Content-Disposition and Content-Type headers with email.message.Message, which transparently applies RFC 2231/5987 decoding. The extended parameter syntax filename=charset'lang'value, name=..., and the filename0/filename1 continuation form is decoded and surfaced...
