9 matches found
CVE-2026-3425 RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'
The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.2 via the 'path' parameter of the 'getcontent' AJAX action. This makes it possible for authenticated attackers, with Author-level access and above, to include and...
CVE-2026-3425
The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.2 via the 'path' parameter of the 'getcontent' AJAX action. This makes it possible for authenticated attackers, with Author-level access and above, to include and...
CVE-2026-3425 RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'
The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.2 via the 'path' parameter of the 'getcontent' AJAX action. This makes it possible for authenticated attackers, with Author-level access and above, to include and...
CVE-2026-3425: Improper Control of Filename for Include/Require Statement in PHP Program
The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.2 via the 'path' parameter of the 'getcontent' AJAX action. This makes it possible for authenticated attackers, with Author-level access and above, to include and...
The vulnerability of the `call_user_func` function in the LearnPress plugin of the WordPress content management system allows a hacker to execute arbitrary code.
The vulnerability of the calluserfunc function in the LearnPress plugin of the WordPress content management system is related to the lack of data cleansing at the control level. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through getcontent...
CVE-2023-6634
The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the getcontent function. This is due to the plugin making use of the calluserfunc function with user input. This makes it possible for unauthenticated attackers to execute any...
CVE-2023-6634: Improper Neutralization of Argument Delimiters in a Command
The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the getcontent function. This is due to the plugin making use of the calluserfunc function with user input. This makes it possible for unauthenticated attackers to execute any...
Cross site request forgery (csrf)
A vulnerability was found in moodle-blocksitenews 1.0. It has been classified as problematic. This affects the function getcontent of the file blocksitenews.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.1 is able ...
CVE-2020-36633: Cross-Site Request Forgery (CSRF)
A vulnerability was found in moodle-blocksitenews 1.0. It has been classified as problematic. This affects the function getcontent of the file blocksitenews.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.1 is able ...