CVE-2023-4591 Inclusion of Functionality from Untrusted Control Sphere in WPN-XM Serverstack

A local file inclusion vulnerability has been found in WPN-XM Serverstack affecting version 0.8.6, which would allow an unauthenticated user to perform a local file inclusion LFI via the /tools/webinterface/index.php?page parameter by sending a GET request. This vulnerability could lead to the...

CVE-2023-39699

CVE-2023-39699 affects IceWarp Mail Server v10.4.5 via a Local File Inclusion (LFI) in the /calendar/minimizer/index.php component. The vulnerability allows an attacker to include or execute files from the server’s local filesystem. Documented impact is high (potential code execution/unauthorized...

GHSA-XVHG-W6QC-M3QQ Yaklang Plugin's Fuzztag Component Allows Unauthorized Local File Reading

Impact The Yak Engine has been found to contain a local file inclusion LFI vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to the unintended exposure of sensitive data, potential...

Yaklang Plugin's Fuzztag Component Allows Unauthorized Local File Reading

Impact The Yak Engine has been found to contain a local file inclusion LFI vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to the unintended exposure of sensitive data, potential...

CVE-2023-40023

yaklang is a programming language designed for cybersecurity. The Yak Engine has been found to contain a local file inclusion LFI vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to t...

Remote code execution

yaklang is a programming language designed for cybersecurity. The Yak Engine has been found to contain a local file inclusion LFI vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to t...

CVE-2023-40023 Yaklang Plugin's Fuzztag Component Allows Unauthorized Local File Reading

yaklang is a programming language designed for cybersecurity. The Yak Engine has been found to contain a local file inclusion LFI vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to t...

Ciuis CRM 1.0.7 Local File Inclusion

==================================================================================================================================== | Title : Ciuis™ CRM v1.0.7 LFI Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 66.0.264-bit | | Vendor :...

Design/Logic Flaw

Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion LFI vulnerability via the component /etc/hosts...

CVE-2023-37601

Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion LFI vulnerability via the component /etc/hosts...

Rukovoditel Project Management CRM 2.4.1 Local File Inclusion

==================================================================================================================================== | Title : Rukovoditel Project Management CRM 2.4.1 LFI Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

Shopping Cart & eCommerce Store < 5.4.3 - Admin+ LFI

The plugin does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks. 1. Login as Admin. 2. Go to wp-admin/admin.php?page=wp-easycart-products&subpage=products 3. Click on Import Products. Browse any file and click on import file. Intercept the...

Remote file inclusion

A Local File Inclusion LFI vulnerability in interface/forms/LBF/new.php in OpenEMR 7.0.0 allows remote authenticated users to execute code via the formname parameter...

Mautic Integration For WooCommerce < 1.0.3 - Arbitrary Options Update via CSRF

The plugin does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, allowing attackers to make a logged in admin change arbitrary blog options via a CSRF attack. The attack could also be performed via a LFI if one is present ...

GHSA-F42P-VC8P-7X54 MobSF allows attackers to read arbitrary files via a crafted HTTP request

Mobile Security Framework MobSF v0.9.2 and below was discovered to contain a local file inclusion LFI vulnerability in the StaticAnalyzer/views.py script. This vulnerability allows attackers to read arbitrary files via a crafted HTTP request...

CVE-2022-22246

A PHP Local File Inclusion LFI vulnerability in the J-Web component of Juniper Networks Junos OS may allow a low-privileged authenticated attacker to execute an untrusted PHP file. By chaining this vulnerability with other unspecified vulnerabilities, and by circumventing existing attack...

CVE-2022-41547

Mobile Security Framework MobSF v0.9.2 and below was discovered to contain a local file inclusion LFI vulnerability in the StaticAnalyzer/views.py script. This vulnerability allows attackers to read arbitrary files via a crafted HTTP request...

CVE-2022-37191

The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using function parameter value as LFI payload...

CVE-2022-37191

The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using function parameter value as LFI payload...

CVE-2022-37191

The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using function parameter value as LFI payload...