CVE-2025-69174: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Etude = 1.6 versions...

CVE-2026-40721: Improper Control of Filename for Include/Require Statement in PHP Program

Contributor Local File Inclusion in Element Pack Pro = 9.0.6 versions...

CVE-2026-39549: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Aperitif = 1.5 versions...

CVE-2026-34895: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Softlab Core 1.2.11 versions...

CVE-2026-22338: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in EcoBlue = 1.15 versions...

CVE-2025-69149: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Top Dog = 1.0.5 versions...

CVE-2025-49403: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Arbitrary File Download in Premium Age Verification / Restriction for WordPress = 3.0.2 versions...

CVE-2026-46851: Improper Control of Generation of Code

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft component: Security. The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS...

CVE-2025-69160: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Gita = 1.11 versions...

CVE-2025-69167: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Eros = 1.3 versions...

PT-2026-49640

Improper Control of Generation of Code 'Code Injection' vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion. This issue affects RD Station: from n/a through 5.6.0...

CVE-2026-5233: Improper Control of Interaction Frequency

Improper Control of Interaction Frequency vulnerability in MIA Technology Inc. Pizzy Library allows Flooding. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250...

CVE-2026-48017: Improper Control of Generation of Code

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user with basic access, ...

CVE-2026-12207: Improper Control of Resource Identifiers

A security flaw has been discovered in medkey-org medkey up to fc09b7ba9441ff590b72d428d5380834216b09ed. Impacted is the function actionGetPatientById of the file app\modules\medical\port\rest\controllers\PatientController.php of the component HTTP REST API. The manipulation of the argument ID...

CVE-2026-47137: Improper Control of Dynamically-Managed Code Resources

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gwmx CVE-2023-37903 introduced a check in nodevm.js line 263 that blocks the combination nesting: true + require: false. However, the check uses strict equality options.require === false, which is...

CVE-2026-42851: Improper Control of Generation of Code

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with cat, a log line, an email body rendered in less, an issue body in a TUI, etc. — can cause kitty to execute...

PT-2026-45743

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Axiomthemes Racquet allows PHP Local File Inclusion. This issue affects Racquet: from n/a through 1.12.0...

CVE-2026-10624: Improper Control of Resource Identifiers

A vulnerability has been found in SourceCodester Human Resource Management 1.0. Affected by this vulnerability is an unknown functionality of the file /detailview.php of the component Employee View Page. Such manipulation of the argument employeeid leads to improper control of resource identifier...

CVE-2025-53440: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Axiomthemes Confidant allows PHP Local File Inclusion. This issue affects Confidant: from n/a through 1.4...

CVE-2026-10299: Improper Control of Resource Identifiers

A weakness has been identified in code-projects Online Hospital Management System 1.0. This issue affects some unknown processing of the file viewdoctortimings.php. This manipulation of the argument delid causes improper control of resource identifiers. The attack can be initiated remotely. The...