2816 matches found
CVE-2026-27555 Local File Inclusion in /index.php/ajax/get_iodd_port_info
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...
PT-2026-93348
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get iodd port info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...
CVE-2026-57119 PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs API
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agentfile path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check. A remote caller can cause the server to open files...
CVE-2026-9166 LFI in GIS Informatics' GisLab Laboratory Management System
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in GIS Informatics GisLab Laboratory Management System allows Path Traversal. This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5...
CVE-2026-9166 LFI in GIS Informatics' GisLab Laboratory Management System
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in GIS Informatics GisLab Laboratory Management System allows Path Traversal. This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5...
WordPress Eventin plugin < 4.1.21 - Contributor+ LFI vulnerability
Contributor+ LFI vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WP Event Solution versions 4.1.21...
WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Jakub Herman in WordPress Plugin Restaurant Menu by MotoPress versions = 2.4.11...
Exploit for Missing Authentication for Critical Function in Oracle Peoplesoft_Enterprise
CVE-2023-22047---Oracle-PeopleSoft-LFI CVE-2023-22047...
WordPress Foton Core plugin <= 1.1.1 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Foton Core versions = 1.1.1...
CVE-2026-56845: Improper Limitation of a Pathname to a Restricted Directory
An unauthenticated path traversal LFI vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory...
CVE-2026-66415: Server-Side Request Forgery (SSRF)
Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to filegetcontents in the Blueprints::import method without path validation. Attackers can...
CVE-2026-63302
Quick.CMS is vulnerable to Local File Inclusion LFI in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure...
Atlassian Confluence Server - Local File Inclusion
Atlassian Confluence Server allows remote attackers to view restricted resources via local file inclusion in the /s/ endpoint. id: CVE-2021-26085 info: name: Atlassian Confluence Server - Local File Inclusion author: princechaddha severity: medium description: Atlassian Confluence Server allows...
CVE-2026-65481: Improper Control of Filename for Include/Require Statement in PHP Program
Contributor Local File Inclusion in Vino = 1.9 versions...
LLaMA Factory's Chat API Contains Critical SSRF and LFI Vulnerabilities
Summary A Server-Side Request Forgery SSRF vulnerability in the chat API allows any authenticated user to force the server to make arbitrary HTTP requests to internal and external networks. This can lead to the exposure of sensitive internal services, reconnaissance of the internal network, or...
CVE-2026-39938: Improper Limitation of a Pathname to a Restricted Directory
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graphtheme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31...
CVE-2025-69141: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Kelly Young = 1.1.0 versions...
CVE-2025-69144: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Preservation = 1.10 versions...